openSUSE-SU-2026:20965-1

openSUSE-SU-2026:20965-1 · Security update for the Linux Kernel

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884). - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502). - CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548). - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619). - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791). - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603). - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619). - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622). - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624). - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615). - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606). - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006). - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062). - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058). - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180). - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794). - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579). - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724). - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115). - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594). - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883). - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040). - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932). - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000). - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091). - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196). - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243). - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245). - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255). - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484). - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415). - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622). - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609). - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114). - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723). - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081). - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672). - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765). - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400). - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394). - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711). - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720). - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810). - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888). - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889). - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827). - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914). - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205). - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214). - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220). - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901). - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696). - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531). - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927). - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972). - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652). - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816). - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826). The following non security issues were fixed: - accel/ivpu: Add bounds checks for firmware log indices (git-fixes). - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes). - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes). - ALSA: seq: dummy: fix UMP event stack overread (git-fixes). - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes). - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes). - Bluetooth: bnep: reject short frames before parsing (git-fixes). - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes). - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes). - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes). - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes). - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes). - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes). - config: remove DEBUG_FS_DISALLOW_MOUNT - debugfs: Remove broken no-mount mode (bsc#1265186). - debugfs: Fix default access mode config check (bsc#1265186). - debugfs: Remove broken no-mount mode (bsc#1265186). - debugfs: Remove redundant access mode checks (bsc#1265186). - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes). - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes). - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes). - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes). - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes). - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes). - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes). - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes). - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes). - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes). - ima: return error early if file xattr cannot be changed (bsc#1261041). - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes). - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes). - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes). - KVM: arm64: vgic-its: Drop the translation cac

Fix available

Published

2026-06-15T13:44:30Z

Updated

2026-06-24T18:24:20.715866003Z

Stack: system

Check your server →