SUSE-IU-2026:7904-1: Security update of suse/sle-micro/rt-5.5
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Thu Oct 15 07:16:42 UTC 2026
SUSE Image Update Advisory: suse/sle-micro/rt-5.5
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:7904-1
Image Tags : suse/sle-micro/rt-5.5:2.0.4 , suse/sle-micro/rt-5.5:2.0.4-4.5.743 , suse/sle-micro/rt-5.5:latest
Image Release : 4.5.743
Severity : important
Type : security
References : 1251966 1252682 1253005 1254633 1266008 1269136 1271906 1273251
1273290 1273339 1273953 1274037 1274836 1275304 1275307 1275470
1275535 1275540 1275543 1275545 1275681 1275696 1275972 1275985
1276006 1276007 1276009 1276277 1276287 1276295 1276337 1276338
1276340 1276353 1276354 1276381 1276388 1276395 1276475 1276519
1276572 1276801 1276803 1276814 1276818 1276821 1277129 1277149
1277249 1277254 1277410 1277489 1277493 1277544 1277553 1277561
1277574 1277590 1277626 1277766 1277792 1277813 1277820 1277837
1277857 1277898 1277901 1277904 1277906 1277908 1278054 1278094
1278108 1278178 1278191 1278210 1278211 1278253 1278294 1278315
1279422 1279487 1279532 1279619 1279621 1279786 1279835 1279875
1280139 1280243 1280263 1280350 1280496 1280727 1280733 1280758
1280786 1280923 1280985 1280993 1281010 1281014 1281042 1281046
1281085 1281229 1281295 1281360 1281546 1281818 1282110 1282113
1282284 1282648 1282881 1282906 1282932 CVE-2022-50645 CVE-2025-39964
CVE-2025-40022 CVE-2026-100075 CVE-2026-43502 CVE-2026-53266
CVE-2026-53400 CVE-2026-64279 CVE-2026-64319 CVE-2026-64422 CVE-2026-64556
CVE-2026-64580 CVE-2026-68155 CVE-2026-68158 CVE-2026-68159 CVE-2026-68376
CVE-2026-68445 CVE-2026-68451 CVE-2026-68452 CVE-2026-68454 CVE-2026-72051
CVE-2026-72052 CVE-2026-72053 CVE-2026-72054 CVE-2026-72055 CVE-2026-72061
CVE-2026-72066 CVE-2026-72083 CVE-2026-72084 CVE-2026-72098 CVE-2026-72129
CVE-2026-72136 CVE-2026-72157 CVE-2026-72164 CVE-2026-72322 CVE-2026-72323
CVE-2026-72339 CVE-2026-72348 CVE-2026-72351 CVE-2026-72383 CVE-2026-72398
CVE-2026-72434 CVE-2026-72449 CVE-2026-74267 CVE-2026-74283 CVE-2026-74330
CVE-2026-74388 CVE-2026-74398 CVE-2026-74406 CVE-2026-74443 CVE-2026-74444
CVE-2026-74453 CVE-2026-74469 CVE-2026-74473 CVE-2026-74479 CVE-2026-74480
CVE-2026-74492 CVE-2026-74493 CVE-2026-74540 CVE-2026-74556 CVE-2026-74586
CVE-2026-74588 CVE-2026-74589 CVE-2026-74597 CVE-2026-74609 CVE-2026-74615
CVE-2026-74616 CVE-2026-74630 CVE-2026-74688 CVE-2026-74700 CVE-2026-74719
CVE-2026-74737 CVE-2026-74743 CVE-2026-74744 CVE-2026-74752 CVE-2026-80540
CVE-2026-80580 CVE-2026-80714 CVE-2026-80716 CVE-2026-80737 CVE-2026-80785
CVE-2026-80789 CVE-2026-80840 CVE-2026-80841 CVE-2026-80844 CVE-2026-80852
CVE-2026-80909 CVE-2026-81000 CVE-2026-89479 CVE-2026-89482 CVE-2026-89532
CVE-2026-89533 CVE-2026-89544 CVE-2026-89551 CVE-2026-89569 CVE-2026-89603
CVE-2026-89631 CVE-2026-89636 CVE-2026-89638 CVE-2026-89674 CVE-2026-89932
CVE-2026-89968 CVE-2026-90003 CVE-2026-90104 CVE-2026-90198 CVE-2026-90413
CVE-2026-90414 CVE-2026-93104 CVE-2026-93782 CVE-2026-93787
-----------------------------------------------------------------
The container suse/sle-micro/rt-5.5 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4665-1
Released: Wed Oct 14 14:53:51 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1251966,1252682,1253005,1254633,1266008,1269136,1271906,1273251,1273290,1273339,1273953,1274037,1274836,1275304,1275307,1275470,1275535,1275540,1275543,1275545,1275681,1275696,1275972,1275985,1276006,1276007,1276009,1276277,1276287,1276295,1276337,1276338,1276340,1276353,1276354,1276381,1276388,1276395,1276475,1276519,1276572,1276801,1276803,1276814,1276818,1276821,1277129,1277149,1277249,1277254,1277410,1277489,1277493,1277544,1277553,1277561,1277574,1277590,1277626,1277766,1277792,1277813,1277820,1277837,1277857,1277898,1277901,1277904,1277906,1277908,1278054,1278094,1278108,1278178,1278191,1278210,1278211,1278253,1278294,1278315,1279422,1279487,1279532,1279619,1279621,1279786,1279835,1279875,1280139,1280243,1280263,1280350,1280496,1280727,1280733,1280758,1280786,1280923,1280985,1280993,1281010,1281014,1281042,1281046,1281085,1281229,1281295,1281360,1281546,1281818,1282110,1282113,1282284,1282648,1282881,1282906,1282932,CVE-2022-50645,CVE-2025-39964,CVE-2025-40022,CVE-
2026-100075,CVE-2026-43502,CVE-2026-53266,CVE-2026-53400,CVE-2026-64279,CVE-2026-64319,CVE-2026-64422,CVE-2026-64556,CVE-2026-64580,CVE-2026-68155,CVE-2026-68158,CVE-2026-68159,CVE-2026-68376,CVE-2026-68445,CVE-2026-68451,CVE-2026-68452,CVE-2026-68454,CVE-2026-72051,CVE-2026-72052,CVE-2026-72053,CVE-2026-72054,CVE-2026-72055,CVE-2026-72061,CVE-2026-72066,CVE-2026-72083,CVE-2026-72084,CVE-2026-72098,CVE-2026-72129,CVE-2026-72136,CVE-2026-72157,CVE-2026-72164,CVE-2026-72322,CVE-2026-72323,CVE-2026-72339,CVE-2026-72348,CVE-2026-72351,CVE-2026-72383,CVE-2026-72398,CVE-2026-72434,CVE-2026-72449,CVE-2026-74267,CVE-2026-74283,CVE-2026-74330,CVE-2026-74388,CVE-2026-74398,CVE-2026-74406,CVE-2026-74443,CVE-2026-74444,CVE-2026-74453,CVE-2026-74469,CVE-2026-74473,CVE-2026-74479,CVE-2026-74480,CVE-2026-74492,CVE-2026-74493,CVE-2026-74540,CVE-2026-74556,CVE-2026-74586,CVE-2026-74588,CVE-2026-74589,CVE-2026-74597,CVE-2026-74609,CVE-2026-74615,CVE-2026-74616,CVE-2026-74630,CVE-2026-74688,CVE-2026-7
4700,CVE-2026-74719,CVE-2026-74737,CVE-2026-74743,CVE-2026-74744,CVE-2026-74752,CVE-2026-80540,CVE-2026-80580,CVE-2026-80714,CVE-2026-80716,CVE-2026-80737,CVE-2026-80785,CVE-2026-80789,CVE-2026-80840,CVE-2026-80841,CVE-2026-80844,CVE-2026-80852,CVE-2026-80909,CVE-2026-81000,CVE-2026-89479,CVE-2026-89482,CVE-2026-89532,CVE-2026-89533,CVE-2026-89544,CVE-2026-89551,CVE-2026-89569,CVE-2026-89603,CVE-2026-89631,CVE-2026-89636,CVE-2026-89638,CVE-2026-89674,CVE-2026-89932,CVE-2026-89968,CVE-2026-90003,CVE-2026-90104,CVE-2026-90198,CVE-2026-90413,CVE-2026-90414,CVE-2026-93104,CVE-2026-93782,CVE-2026-93787
The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
- CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
- CVE-2025-40022: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
- CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
- CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
- CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
(bsc#1276519).
- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
- CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
- CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
- CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
- CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
(bsc#1276572).
- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
- CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
- CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
- CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
- CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
- CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).
- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).
- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).
The following non security issues were fixed:
- Disable BATMAN in supported.conf.
- Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
- Disable CONFIG_CAN (jsc#PED-16993).
- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
- fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223
jsc#PED-1225).
- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
- kernel-binary.spec.in: Fix syntax error.
- net: mana: Cap MSI-X vectors to the device MSI-X table size (bsc#1277254).
- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
- net: mana: Fall back to scattered pages for GDMA queues (bsc#1281085).
- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
- perf: Reject exited events as group leaders (git-fixes).
- slab: Introduce kmalloc_obj() and family (bsc#1280139).
- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
- smb: client: fix data/file corruption on reconnects (bsc#1253005).
- smb: client: fix stuck kworkers on reconnects during writes (bsc#1253005).
The following package changes have been done:
- kernel-rt-5.14.21-150500.13.164.1 updated
- container:suse-sle-micro-5.5-latest-2.0.4-5.8.128 updated
More information about the sle-container-updates
mailing list