SUSE-SU-2026:4282-1

SUSE-SU-2026:4282-1 · Security update for the Linux Kernel

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619). - CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541). - CVE-2026-43134: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (bsc#1264308). - CVE-2026-43257: media: cx88: Add missing unmap in snd_cx88_hw_params() (bsc#1264296). - CVE-2026-43277: ACPI / APEI: Make GHES estatus header validation more user friendly (bsc#1264594). - CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068). - CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121). - CVE-2026-45941: tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (bsc#1266920). - CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501). - CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612). - CVE-2026-46108: ipmi:si: Return state to normal if message allocation fails (bsc#1267615). - CVE-2026-46128: ipmi: Check event message buffer response for bad data (bsc#1267643). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013). - CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987). - CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972). - CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113). - CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685). - CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412). - CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783). - CVE-2026-53091: net: do not use skb_mac_header() in qdisc_pkt_len_init() (bsc#1269530). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306). - CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686). - CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381). - CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301). - CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256). - CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774). - CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238). - CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815). - CVE-2026-53403: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in (bsc#1271731). - CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297). - CVE-2026-63823: security: don't use RCU accessors for cred->session_keyring (bsc#1272182). - CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429). - CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385). - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390). - CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426). - CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877). - CVE-2026-63962: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (bsc#1272482). - CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027). - CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734). - CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774). - CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831). - CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105). - CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882). - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891). - CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762). - CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463). - CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759). - CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748). - CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742). - CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745). - CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749). - CVE-2026-64178: Bluetooth: bnep: Fix UAF read of dev->name (bsc#1273946). - CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210). - CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944). - CVE-2026-64306: crypto: drbg - Fix returning success on failure in CTR_DRBG (bsc#1273939). - CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968). - CVE-2026-64313: crypto: ecc - Fix carry overflow in vli multiplication (bsc#1273940). - CVE-2026-64315: printk: add print_hex_dump_devel() (bsc#1274028). - CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936). - CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958). - CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305). - CVE-2026-64332: USB: ulpi: fix memory leak on registration failure (bsc#1273285). - CVE-2026-64333: USB: serial: digi_acceleport: fix write buffer corruption (bsc#1273933). - CVE-2026-64334: USB: serial: digi_acceleport: fix hard lockup on disconnect (bsc#1273942). - CVE-2026-64340: USB: legousbtower: fix use-after-free on disconnect race (bsc#1274003). - CVE-2026-64341: USB: iowarrior: fix use-after-free on disconnect race (bsc#1273895). - CVE-2026-64343: USB: ldusb: fix use-after-free on disconnect race (bsc#1273974). - CVE-2026-64344: USB: idmouse: simplify disconnect handling (bsc#1274019). - CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860). - CVE-2026-64408: Bluetooth: bnep: pin L2CAP connection during netdev registration (bsc#1273778). - CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077). - CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780). - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274). - CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277). - CVE-2026-64470: Bluetooth: btusb: fix use-after-free on marvell probe failure (bsc#1273892). - CVE-2026-64471: Bluetooth: btusb: fix use-after-free on registration failure (bsc#1274278). - CVE-2026-64512: ACPI: CPPC: Suppress UBSAN warning caused by field misuse (bsc#1273597). - CVE-2026-64513: KVM: x86: Move update_cr8_intercept() to lapic.

Fix available

Published

2026-09-22T08:34:06Z

Updated

2026-09-23T09:15:05.361999881Z

Stack: system

Check your server →