openSUSE-SU-2026:22167-1

openSUSE-SU-2026:22167-1 · Security update for the Linux Kernel

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042). - CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430). - CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561). - CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178). - CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764). - CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898). - CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901). - CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952). - CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955). - CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956). - CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509). - CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751). - CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599). - CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256). - CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039). - CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080). - CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865). - CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644). - CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785). - CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786). - CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653). - CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791). - CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836). - CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510). - CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174). - CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357). - CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691). - CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695). - CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602). - CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603). - CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614). - CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663). - CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665). - CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747). - CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964). - CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330). - CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033). - CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951). - CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907). - CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873). - CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103). - CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232). - CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894). - CVE-2026-74578: crypto: algif_skcipher - force synchronous processing (bsc#1275564). - CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889). - CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821). - CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804). - CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931). - CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599). - CVE-2026-74715: bpf: Fix netns reference imbalance in conntrack kfuncs (bsc#1277890). - CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338). - CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode (bsc#1277260). - CVE-2026-80893: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (bsc#1279706). - CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259). - CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743). - CVE-2026-89558: md/raid10: fix still_degraded being inverted in raid10_sync_request() (bsc#1280552). - CVE-2026-89593: hugetlb: only adjust reservation during unmapping if mapcount is 0 (bsc#1280229). - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496). - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042). - CVE-2026-89640: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (bsc#1280950). - CVE-2026-89754: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (bsc#1280769). - CVE-2026-89755: mm/migrate_device: clear stale mapping after freeing swapcache (bsc#1280770). - CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966). - CVE-2026-89811: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (bsc#1281144). - CVE-2026-89987: mm/huge_memory: transfer the pmd dirty bit to the folio on zap (bsc#1281819). - CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280). - CVE-2026-90283: hugetlbfs: release subpool on fill_super failure (bsc#1281771). - CVE-2026-90289: drm/amd/display: Resize MST HDCP per-connector arrays to 32 (bsc#1281726). - CVE-2026-93066: x86/mm/pat: Take cpa_lock around large-page collapse (bsc#1282274). - CVE-2026-93134: printk: Fix possible console use-after-free (bsc#1281162). - CVE-2026-93222: signal: avoid shared siginfo namespace rewrites (bsc#1282742). - CVE-2026-93252: ocfs2: fix circular locking dependency in ocfs2_init_acl() (bsc#1282784). - CVE-2026-93785: cifs: validate idmap key payload length (bsc#1282869). - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932). - CVE-2026-93798: btrfs: fix reloc root cleanup in merge_reloc_roots() (bsc#1282769). - CVE-2026-93806: wifi: cfg80211: validate assoc response length before status and IE access (bsc#1283037). - CVE-2026-97415: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (bsc#1282768). - CVE-2026-97416: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (bsc#1282770). - CVE-2026-97491: net/rds: Don't sleep inside rds_ib_conn_path_shutdown (bsc#1283142). - CVE-2026-97533: x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF (bsc#1283454). - CVE-2026-97554: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() (bsc#1283850). - CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851). - CVE-2026-97556: smb: client: avoid leaking refcount when cifs_sb_tlink() fails (bsc#1283853). - CVE-2026-97558: smb: client: fix cifsFileInfo reference leak in deferred close (bsc#1283855). - CVE-2026-97559: smb: client: fail DACL rewrite wh

Fix available

Published

2026-10-24T12:35:03Z

Updated

2026-10-25T17:30:03.891806908Z

Stack: system

Check your server →