Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)
This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues:
The following security issues were fixed:
- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386).
- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).
Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)
This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues:
The following security issues were fixed:
- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
- CVE-2026-68202: ALSA: seq: close a re-open
Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)
This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes one security issue:
The following security issue was fixed:
- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
- CVE-2026-31510: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (bsc#1262603).
- CVE-2026-31624: HID: core: clamp report_size in s32ton() to avoid undefined shift (bsc#1263657).
- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
- CVE-2026-43069: Bluetooth: hci_ll: Fix firmware leak on error path (bsc#1264190).
- CVE-2026-43123: fbcon: check return value of con2fb_acquire_ne