{"id":"CVE-2026-3150","aliases":["EUVD-2026-8623","GHSA-4v56-g6h4-6655","SUSE-SU-2026:22048-1","SUSE-SU-2026:22076-1","SUSE-SU-2026:22087-1","SUSE-SU-2026:22108-1","SUSE-SU-2026:22137-1","SUSE-SU-2026:2450-1","SUSE-SU-2026:2482-1","SUSE-SU-2026:2591-1","openSUSE-SU-2026:20912-1"],"status":"published","title":"itsourcecode College Management System display-teacher.php sql injection","description":"A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00304,"percentile":0.23401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74","CWE-89"],"published":"2026-02-25T04:32:08Z","modified":"2026-06-24T09:00:17Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1.160000.2.15"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1.160000.2.15"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1.160000.2.15"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1.21.24"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1.21.24"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-47.1"}]}],"bundled":98},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.317.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kgraft-patch-SLE12-SP5_Update_84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-8.7.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.317.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.317.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.317.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.317.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.317.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.317.1"}]}],"bundled":84},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1.150700.17.35.4"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.2"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.2"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.60.1"}]}],"bundled":103},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.5.2"}]}],"bundled":102},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.59.2"}]}],"bundled":102},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.59.2"}]}],"bundled":102},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.59.1"}]}],"bundled":102}],"products":[{"vendor":"angeljudesuarez","product":"college_management_system"},{"vendor":"itsourcecode","product":"college management system"}],"references":[{"url":"https://vuldb.com/?id.347658","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?ctiid.347658","tags":["signature","permissions-required","Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?submit.758829","tags":["third-party-advisory","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/Zhangchao404/cve/issues/2","tags":["exploit","issue-tracking","Exploit","Issue Tracking","Mitigation","Third Party Advisory"]},{"url":"https://itsourcecode.com/","tags":["product","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3150"},{"url":"https://itsourcecode.com"},{"url":"https://github.com/advisories/GHSA-4v56-g6h4-6655"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622048-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1260539","tags":["report"]},{"url":"https://bugzilla.suse.com/1260584","tags":["report"]},{"url":"https://bugzilla.suse.com/1261590","tags":["report"]},{"url":"https://bugzilla.suse.com/1262634","tags":["report"]},{"url":"https://bugzilla.suse.com/1262656","tags":["report"]},{"url":"https://bugzilla.suse.com/1262668","tags":["report"]},{"url":"https://bugzilla.suse.com/1262754","tags":["report"]},{"url":"https://bugzilla.suse.com/1262755","tags":["report"]},{"url":"https://bugzilla.suse.com/1262771","tags":["report"]},{"url":"https://bugzilla.suse.com/1263067","tags":["report"]},{"url":"https://bugzilla.suse.com/1263068","tags":["report"]},{"url":"https://bugzilla.suse.com/1263102","tags":["report"]},{"url":"https://bugzilla.suse.com/1263169","tags":["report"]},{"url":"https://bugzilla.suse.com/1263769","tags":["report"]},{"url":"https://bugzilla.suse.com/1263774","tags":["report"]},{"url":"https://bugzilla.suse.com/1263908","tags":["report"]},{"url":"https://bugzilla.suse.com/1264011","tags":["report"]},{"url":"https://bugzilla.suse.com/1264014","tags":["report"]},{"url":"https://bugzilla.suse.com/1264016","tags":["report"]},{"url":"https://bugzilla.suse.com/1264063","tags":["report"]},{"url":"https://bugzilla.suse.com/1264112","tags":["report"]},{"url":"https://bugzilla.suse.com/1264300","tags":["report"]},{"url":"https://bugzilla.suse.com/1264409","tags":["report"]},{"url":"https://bugzilla.suse.com/1264437","tags":["report"]},{"url":"https://bugzilla.suse.com/1264669","tags":["report"]},{"url":"https://bugzilla.suse.com/1264716","tags":["report"]},{"url":"https://bugzilla.suse.com/1264719","tags":["report"]},{"url":"https://bugzilla.suse.com/1264720","tags":["report"]},{"url":"https://bugzilla.suse.com/1264722","tags":["report"]},{"url":"https://bugzilla.suse.com/1264726","tags":["report"]},{"url":"https://bugzilla.suse.com/1264832","tags":["report"]},{"url":"https://bugzilla.suse.com/1264989","tags":["report"]},{"url":"https://bugzilla.suse.com/1265044","tags":["report"]},{"url":"https://bugzilla.suse.com/1265110","tags":["report"]},{"url":"https://bugzilla.suse.com/1265925","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1266001","tags":["report"]},{"url":"https://bugzilla.suse.com/1266238","tags":["report"]},{"url":"https://bugzilla.suse.com/1266307","tags":["report"]},{"url":"https://bugzilla.suse.com/1266395","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266414","tags":["report"]},{"url":"https://bugzilla.suse.com/1266759","tags":["report"]},{"url":"https://bugzilla.suse.com/1266765","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-20585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46243","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622076-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622087-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622108-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248235","tags":["report"]},{"url":"https://bugzilla.suse.com/1255416","tags":["report"]},{"url":"https://bugzilla.suse.com/1258538","tags":["report"]},{"url":"https://bugzilla.suse.com/1260502","tags":["report"]},{"url":"https://bugzilla.suse.com/1261619","tags":["report"]},{"url":"https://bugzilla.suse.com/1261791","tags":["report"]},{"url":"https://bugzilla.suse.com/1262606","tags":["report"]},{"url":"https://bugzilla.suse.com/1262615","tags":["report"]},{"url":"https://bugzilla.suse.com/1262619","tags":["report"]},{"url":"https://bugzilla.suse.com/1262622","tags":["report"]},{"url":"https://bugzilla.suse.com/1262624","tags":["report"]},{"url":"https://bugzilla.suse.com/1262649","tags":["report"]},{"url":"https://bugzilla.suse.com/1262663","tags":["report"]},{"url":"https://bugzilla.suse.com/1263006","tags":["report"]},{"url":"https://bugzilla.suse.com/1263115","tags":["report"]},{"url":"https://bugzilla.suse.com/1263143","tags":["report"]},{"url":"https://bugzilla.suse.com/1263152","tags":["report"]},{"url":"https://bugzilla.suse.com/1263319","tags":["report"]},{"url":"https://bugzilla.suse.com/1263562","tags":["report"]},{"url":"https://bugzilla.suse.com/1263724","tags":["report"]},{"url":"https://bugzilla.suse.com/1263790","tags":["report"]},{"url":"https://bugzilla.suse.com/1263883","tags":["report"]},{"url":"https://bugzilla.suse.com/1263932","tags":["report"]},{"url":"https://bugzilla.suse.com/1263945","tags":["report"]},{"url":"https://bugzilla.suse.com/1264000","tags":["report"]},{"url":"https://bugzilla.suse.com/1264091","tags":["report"]},{"url":"https://bugzilla.suse.com/1264093","tags":["report"]},{"url":"https://bugzilla.suse.com/1264124","tags":["report"]},{"url":"https://bugzilla.suse.com/1264184","tags":["report"]},{"url":"https://bugzilla.suse.com/1264243","tags":["report"]},{"url":"https://bugzilla.suse.com/1264245","tags":["report"]},{"url":"https://bugzilla.suse.com/1264255","tags":["report"]},{"url":"https://bugzilla.suse.com/1264430","tags":["report"]},{"url":"https://bugzilla.suse.com/1264449","tags":["report"]},{"url":"https://bugzilla.suse.com/1264476","tags":["report"]},{"url":"https://bugzilla.suse.com/1264484","tags":["report"]},{"url":"https://bugzilla.suse.com/1264551","tags":["report"]},{"url":"https://bugzilla.suse.com/1264671","tags":["report"]},{"url":"https://bugzilla.suse.com/1264672","tags":["report"]},{"url":"https://bugzilla.suse.com/1264765","tags":["report"]},{"url":"https://bugzilla.suse.com/1264805","tags":["report"]},{"url":"https://bugzilla.suse.com/1265020","tags":["report"]},{"url":"https://bugzilla.suse.com/1265073","tags":["report"]},{"url":"https://bugzilla.suse.com/1265128","tags":["report"]},{"url":"https://bugzilla.suse.com/1265170","tags":["report"]},{"url":"https://bugzilla.suse.com/1265240","tags":["report"]},{"url":"https://bugzilla.suse.com/1265579","tags":["report"]},{"url":"https://bugzilla.suse.com/1265960","tags":["report"]},{"url":"https://bugzilla.suse.com/1266009","tags":["report"]},{"url":"https://bugzilla.suse.com/1266214","tags":["report"]},{"url":"https://bugzilla.suse.com/1266394","tags":["report"]},{"url":"https://bugzilla.suse.com/1266400","tags":["report"]},{"url":"https://bugzilla.suse.com/1266452","tags":["report"]},{"url":"https://bugzilla.suse.com/1266696","tags":["report"]},{"url":"https://bugzilla.suse.com/1266697","tags":["report"]},{"url":"https://bugzilla.suse.com/1266711","tags":["report"]},{"url":"https://bugzilla.suse.com/1266720","tags":["report"]},{"url":"https://bugzilla.suse.com/1266767","tags":["report"]},{"url":"https://bugzilla.suse.com/1266810","tags":["report"]},{"url":"https://bugzilla.suse.com/1266816","tags":["report"]},{"url":"https://bugzilla.suse.com/1266826","tags":["report"]},{"url":"https://bugzilla.suse.com/1266827","tags":["report"]},{"url":"https://bugzilla.suse.com/1266889","tags":["report"]},{"url":"https://bugzilla.suse.com/1266901","tags":["report"]},{"url":"https://bugzilla.suse.com/1266927","tags":["report"]},{"url":"https://bugzilla.suse.com/1266969","tags":["report"]},{"url":"https://bugzilla.suse.com/1266972","tags":["report"]},{"url":"https://bugzilla.suse.com/1267205","tags":["report"]},{"url":"https://bugzilla.suse.com/1267214","tags":["report"]},{"url":"https://bugzilla.suse.com/1267218","tags":["report"]},{"url":"https://bugzilla.suse.com/1267220","tags":["report"]},{"url":"https://bugzilla.suse.com/1267222","tags":["report"]},{"url":"https://bugzilla.suse.com/1267531","tags":["report"]},{"url":"https://bugzilla.suse.com/1267626","tags":["report"]},{"url":"https://bugzilla.suse.com/1267652","tags":["report"]},{"url":"https://bugzilla.suse.com/1267663","tags":["report"]},{"url":"https://bugzilla.suse.com/1267726","tags":["report"]},{"url":"https://bugzilla.suse.com/1267732","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622137-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262450-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255084","tags":["report"]},{"url":"https://bugzilla.suse.com/1256668","tags":["report"]},{"url":"https://bugzilla.suse.com/1260018","tags":["report"]},{"url":"https://bugzilla.suse.com/1260468","tags":["report"]},{"url":"https://bugzilla.suse.com/1260729","tags":["report"]},{"url":"https://bugzilla.suse.com/1260731","tags":["report"]},{"url":"https://bugzilla.suse.com/1261700","tags":["report"]},{"url":"https://bugzilla.suse.com/1261750","tags":["report"]},{"url":"https://bugzilla.suse.com/1262061","tags":["report"]},{"url":"https://bugzilla.suse.com/1262099","tags":["report"]},{"url":"https://bugzilla.suse.com/1262614","tags":["report"]},{"url":"https://bugzilla.suse.com/1262620","tags":["report"]},{"url":"https://bugzilla.suse.com/1262751","tags":["report"]},{"url":"https://bugzilla.suse.com/1262752","tags":["report"]},{"url":"https://bugzilla.suse.com/1262757","tags":["report"]},{"url":"https://bugzilla.suse.com/1262993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263011","tags":["report"]},{"url":"https://bugzilla.suse.com/1263012","tags":["report"]},{"url":"https://bugzilla.suse.com/1263140","tags":["report"]},{"url":"https://bugzilla.suse.com/1263165","tags":["report"]},{"url":"https://bugzilla.suse.com/1263568","tags":["report"]},{"url":"https://bugzilla.suse.com/1263578","tags":["report"]},{"url":"https://bugzilla.suse.com/1263887","tags":["report"]},{"url":"https://bugzilla.suse.com/1263923","tags":["report"]},{"url":"https://bugzilla.suse.com/1263930","tags":["report"]},{"url":"https://bugzilla.suse.com/1263934","tags":["report"]},{"url":"https://bugzilla.suse.com/1263995","tags":["report"]},{"url":"https://bugzilla.suse.com/1264006","tags":["report"]},{"url":"https://bugzilla.suse.com/1264076","tags":["report"]},{"url":"https://bugzilla.suse.com/1264097","tags":["report"]},{"url":"https://bugzilla.suse.com/1264470","tags":["report"]},{"url":"https://bugzilla.suse.com/1264595","tags":["report"]},{"url":"https://bugzilla.suse.com/1264603","tags":["report"]},{"url":"https://bugzilla.suse.com/1264610","tags":["report"]},{"url":"https://bugzilla.suse.com/1264630","tags":["report"]},{"url":"https://bugzilla.suse.com/1264763","tags":["report"]},{"url":"https://bugzilla.suse.com/1265456","tags":["report"]},{"url":"https://bugzilla.suse.com/1266290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266390","tags":["report"]},{"url":"https://bugzilla.suse.com/1266411","tags":["report"]},{"url":"https://bugzilla.suse.com/1266704","tags":["report"]},{"url":"https://bugzilla.suse.com/1267369","tags":["report"]},{"url":"https://bugzilla.suse.com/1267387","tags":["report"]},{"url":"https://bugzilla.suse.com/1267624","tags":["report"]},{"url":"https://bugzilla.suse.com/1267651","tags":["report"]},{"url":"https://bugzilla.suse.com/1267685","tags":["report"]},{"url":"https://bugzilla.suse.com/1267713","tags":["report"]},{"url":"https://bugzilla.suse.com/1267816","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46273","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260548","tags":["report"]},{"url":"https://bugzilla.suse.com/1261591","tags":["report"]},{"url":"https://bugzilla.suse.com/1263122","tags":["report"]},{"url":"https://bugzilla.suse.com/1264040","tags":["report"]},{"url":"https://bugzilla.suse.com/1264415","tags":["report"]},{"url":"https://bugzilla.suse.com/1264835","tags":["report"]},{"url":"https://bugzilla.suse.com/1266036","tags":["report"]},{"url":"https://bugzilla.suse.com/1266888","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45898","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262591-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-3150","title":"itsourcecode College Management System display-teacher.php sql injection","description":"A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.","status":"published","published":"2026-02-25T04:32:08.455Z","modified":"2026-02-25T14:49:09.203Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-89","CWE-74"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-8623","description":"A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.","status":"published","published":"2026-02-25T04:32:08Z","modified":"2026-02-25T14:49:09Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:29.551855Z"}],"ghsa":[{"id":"GHSA-4v56-g6h4-6655","title":"A security vulnerability has been detected in itsourcecode College Management System 1.0. This...","description":"A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.","status":"published","published":"2026-02-25T06:31:15Z","modified":"2026-02-25T18:32:45Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-74","CWE-89"],"updated_at":"2026-11-02T15:06:22.774985Z"}],"nvd":[{"id":"CVE-2026-3150","description":"A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.","status":"published","published":"2026-02-25T05:17:29.067Z","modified":"2026-06-17T10:43:07.63Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-74","CWE-89"],"updated_at":"2026-11-02T14:12:07.027269Z"}],"osv":[{"id":"openSUSE-SU-2026:20912-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T18:24:53Z","modified":"2026-06-09T09:00:07.336575283Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22048-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T17:10:52Z","modified":"2026-06-10T18:24:10.930842247Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22076-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T16:14:08Z","modified":"2026-06-16T18:24:27.834198043Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22087-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T17:10:52Z","modified":"2026-06-16T18:24:45.453161715Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22108-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n\nThe following non-security bugs were fixed:\n\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-15T18:32:29Z","modified":"2026-06-17T09:15:06.724017524Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22137-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n\nThe following non-security bugs were fixed:\n\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)\n- RDMA/efa: Extend admin timeout error print (git-fixes)\n- RDMA/efa: Fix possible deadlock (git-fixes)\n- RDMA/efa: Improve admin completion context state machine (git-fixes)\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Do not validate the firmware when already validated (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: do not dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) do not clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: do not merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538).\n- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538).\n- rpm: Add BuildRequires for Rust enablement (bsc#1258538).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes)\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thunderbolt: property: Reject dir_len \u0026lt; 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-15T17:11:08Z","modified":"2026-06-18T18:24:22.740905876Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2450-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: Add workaround for Cortex-A76 erratum 1286807 (bsc#1266290).\n- CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23279: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (bsc#1260468).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23367: wifi: radiotap: reject radiotap with unknown bits (bsc#1260731).\n- CVE-2026-23396: wifi: mac80211: fix NULL deref in mesh_matches_local() (bsc#1260729).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-23448: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (bsc#1261750).\n- CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31447: ext4: reject mount if bigalloc with s_first_data_block != 0 (bsc#1262614).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31498: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (bsc#1262751).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31532: can: af_can: export can_sock_destruct() (bsc#1262757).\n- CVE-2026-31540: drm/i915/gt: Check set_default_submission() before deferencing (bsc#1263011).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31778: ALSA: caiaq: fix stack out-of-bounds read in init_card (bsc#1263923).\n- CVE-2026-43020: Bluetooth: MGMT: validate LTK enc_size on load (bsc#1264006).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n  leak (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43140: HID: magicmouse: Do not crash on missing msc-\u003einput (bsc#1264630).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n- CVE-2026-45835: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (bsc#1266411).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46169: hfsplus: fix uninit-value by validating catalog record size (bsc#1267713).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non security issues were fixed:\n\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- kvm/svm: PKU not currently supported (bsc#1263887).\n- KVM: x86: Handle PKU CPUID adjustment in VMX code (bsc#1263887).\n- mkspec: Add signature to source list only when it exists.\n- net/sched: cls_fw: fix NULL dereference of 'old' filters before change() (git-fixes).\n","status":"published","published":"2026-06-18T13:36:00Z","modified":"2026-06-19T08:15:05.66245493Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2482-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n  (bsc#1260548).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n  leak (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43150: perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- cgroup: Increment nr_dying_subsys_* from rmdir context (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: process XSK TX descriptors as part of RX NAPI (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261591).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1261591).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/mm: Add missing secure storage access fixups for donated memory (bsc#1264835).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1261591).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- scsi: qla2xxx: Add support to report MPI FW state (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-22T11:10:39Z","modified":"2026-06-24T09:00:12.545896102Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2591-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).\n- CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).\n- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n  (bsc#1260548).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).\n- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).\n- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).\n- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).\n- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).\n- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).\n- CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).\n- CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).\n- CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).\n- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).\n- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).\n- CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).\n- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).\n- CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).\n- CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).\n- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).\n- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-\n  leak (bsc#1264091).\n- CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).\n- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).\n- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).\n- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43150: perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43249: 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43261: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430).\n- CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (bsc#1264805).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).\n- CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).\n- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).\n- CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).\n- CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (bsc#1265128).\n- CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).\n- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).\n- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).\n- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).\n- CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).\n- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).\n- CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).\n- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).\n- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).\n- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).\n- CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).\n- CVE-2026-45984: gfs2: Add metapath_dibh helper (bsc#1267214).\n- CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).\n- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).\n- CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).\n- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).\n- CVE-2026-46079: rbd: fix null-ptr-deref when device_add_disk() fails (bsc#1266452).\n- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).\n- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).\n- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n- CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync (bsc#1267626).\n- CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).\n- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).\n- CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).\n- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).\n- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).\n- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).\n- CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (bsc#1267663).\n- CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: sc6000: Use standard print API (stable-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).\n- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes).\n- ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes).\n- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes).\n- batman-adv: clear current gateway during teardown (git-fixes).\n- batman-adv: dat: handle forward allocation error (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix fragment reassembly length accounting (git-fixes).\n- batman-adv: fix tp_meter counter underflow during shutdown (git-fixes).\n- batman-adv: frag: disallow unicast fragment in fragment (git-fixes).\n- batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes).\n- batman-adv: tt: fix negative last_changeset_len (git-fixes).\n- batman-adv: tt: fix negative tt_buff_len (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: bnep: reject short frames before parsing (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- cgroup: Increment nr_dying_subsys_* from rmdir context (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).\n- drm/amd/display: Reject gpio_bitshift \u003e= 32 in bios_parser_get_gpio_pin_info() (git-fixes).\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).\n- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes).\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: process XSK TX descriptors as part of RX NAPI (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- mmc: core: Fix host controller programming for fixed driver type (git-fixes).\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- parport: Fix race between port and client registration (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261591).\n- s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1261591).\n- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).\n- s390/mm: Add missing secure storage access fixups for donated memory (bsc#1264835).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1261591).\n- s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).\n- sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649).\n- scsi: qla2xxx: Add support to report MPI FW state (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: st-ssc4: switch to use modern name (stable-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).\n- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).\n","status":"published","published":"2026-06-23T14:31:51Z","modified":"2026-06-24T09:00:17.492290835Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}