SUSE-SU-2026:21834-1

SUSE-SU-2026:21834-1 · Security update for the Linux Kernel

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603). - CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420). - CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471). - CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360). - CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160). - CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837). - CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826). - CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799). - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018). - CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012). - CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538). - CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555). - CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573). - CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505). - CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523). - CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529). - CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526). - CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801). - CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530). - CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811). - CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576). - CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546). - CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566). - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531). - CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728). - CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020). - CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410). - CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617). - CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635). - CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641). - CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768). - CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581). - CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702). - CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779). - CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584). - CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687). - CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703). - CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686). - CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781). - CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692). - CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636). - CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694). - CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788). - CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786). - CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645). - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638). - CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796). - CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629). - CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632). - CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752). - CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099). - CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100). - CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055). - CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061). - CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054). - CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063). - CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053). - CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074). - CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086). - CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087). - CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601). - CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616). - CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617). - CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627). - CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671). - CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673). - CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077). - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085). - CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093). - CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095). - CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752). - CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012). - CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725). - CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662). - CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001). - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758). - CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018). - CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104). - CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107). - CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064). - CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074). - CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176). - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165). - CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc

Correctif disponible

Publication

2026-05-28T11:12:43Z

Mise à jour

2026-07-09T18:24:07.906973973Z

Pile logicielle: system

Vérifiez votre serveur →