SUSE-CU-2026:12391-1: Security update of elemental/base-os-kernel-rt
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Sat Oct 17 07:29:38 UTC 2026
SUSE Container Update Advisory: elemental/base-os-kernel-rt
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12391-1
Container Tags : elemental/base-os-kernel-rt:16.0 , elemental/base-os-kernel-rt:16.0-4.24
Container Release : 4.24
Severity : critical
Type : security
References : 1205588 1216378 1218459 1221126 1222465 1228081 1228659 1228728
1231986 1232226 1232234 1234765 1234959 1236282 1237515 1244449
1245524 1245551 1245636 1245738 1245953 1246013 1246231 1247242
1247432 1247850 1247858 1248261 1248356 1248501 1248516 1248842
1249088 1249385 1250232 1250233 1250234 1250553 1250655 1250664
1251948 1251981 1252148 1252306 1252696 1252930 1252931 1252932
1252933 1252934 1252935 1253025 1253043 1253139 1253340 1253679
1254157 1254158 1254159 1254160 1254264 1254299 1254336 1254415
1254480 1254563 1254666 1254679 1254924 1254924 1254928 1255326
1255326 1256341 1256427 1256436 1256466 1256525 1256526 1256766
1256804 1256805 1256807 1256808 1256809 1256810 1256811 1256812
1256822 1256829 1256830 1256831 1256832 1256833 1256834 1256835
1256836 1256837 1256838 1256839 1256840 1257005 1257055 1257274
1257364 1257365 1257463 1257463 1257593 1257594 1257595 1257661
1258020 1258022 1258311 1258319 1258335 1258344 1258392 1258859
1259071 1259118 1259132 1259215 1259418 1259418 1259543 1259650
1259650 1259652 1259652 1259697 1259825 1259924 1260078 1260082
1260357 1260441 1260442 1260443 1260444 1260445 1260474 1260754
1260755 1261206 1261280 1261400 1261564 1261606 1261606 1261639
1261678 1261809 1261816 1261957 1261982 1261983 1262144 1262305
1262315 1262464 1262465 1262684 1262693 1262719 1263078 1263117
1263656 1263658 1264330 1264607 1264747 1266304 1266340 1266341
1266342 1266343 1266344 1266345 1266347 1266349 1266350 1266351
1266352 1266353 1266355 1266356 1266357 1266361 1266410 1266786
1266848 1267464 1267644 1267647 1267672 1268290 1268349 1268747
1268867 1268886 1269084 1269150 1269571 1269583 1269584 1269622
1269623 1269790 1270219 1270439 1271045 1271351 1271352 1271354
1271372 1271386 1271444 1271602 1271712 1271817 1271901 1271950
1271980 1272145 1272215 1272347 1272388 1272473 1272554 1272571
1272616 1272802 1272803 1272890 1273040 1273059 1273116 1273258
1273275 1273290 1273297 1273320 1273491 1273512 1273784 1273879
1273889 1273938 1273970 1273976 1273982 1274037 1274061 1274245
1274297 1274298 1274316 1274319 1274538 1274629 1274663 1274723
1274726 1274774 1274776 1274777 1274788 1274790 1274791 1274792
1274795 1274796 1274797 1274798 1274818 1274824 1274836 1274890
1274912 1274920 1275137 1275142 1275170 1275441 1275495 1275543
1275545 1275549 1275559 1275567 1275682 1275740 1275837 1275924
1275953 1275972 1275977 1276007 1276009 1276262 1276287 1276295
1276337 1276338 1276340 1276345 1276347 1276349 1276352 1276353
1276388 1276460 1276461 1276462 1276474 1276475 1276504 1276508
1276519 1276532 1276535 1276538 1276563 1276565 1276570 1276573
1276579 1276783 1276852 1276892 1276921 1276923 1276927 1276930
1276946 1276947 1277030 1277032 1277036 1277098 1277101 1277109
1277122 1277128 1277129 1277143 1277149 1277153 1277215 1277217
1277218 1277234 1277245 1277247 1277262 1277272 1277277 1277296
1277314 1277342 1277371 1277372 1277374 1277379 1277382 1277392
1277396 1277401 1277405 1277410 1277452 1277489 1277493 1277555
1277556 1277557 1277558 1277568 1277615 1277625 1277626 1277640
1277662 1277674 1277705 1277707 1277708 1277709 1277710 1277711
1277712 1277713 1277766 1277781 1277784 1277792 1277801 1277805
1277820 1277823 1277824 1277840 1277843 1277844 1277857 1277864
1277885 1277892 1277895 1277896 1277897 1277900 1277904 1277906
1277910 1277913 1277915 1277919 1277921 1277922 1278031 1278035
1278053 1278054 1278056 1278063 1278067 1278087 1278091 1278100
1278191 1278195 1278199 1278205 1278215 1278216 1278225 1278245
1278247 1278255 1278311 1278314 1278315 1278347 1278348 1278349
1278363 1278708 1278729 1279116 1279497 1279525 1279527 1279532
1279535 1279536 1279569 1279581 1279590 1279621 1279702 1279786
1279799 1279819 1279835 1279850 1279875 1279878 1279888 1279893
1280049 1280050 1280051 1280052 1280053 1280054 1280143 1280146
1280148 1280151 1280163 1280166 1280171 1280178 1280179 1280184
1280193 1280206 1280235 1280237 1280243 1280251 1280252 1280263
1280296 1280298 1280299 1280303 1280309 1280333 1280334 1280335
1280336 1280338 1280350 1280375 1280379 1280383 1280384 1280387
1280388 1280449 1280451 1280455 1280456 1280464 1280468 1280477
1280487 1280488 1280490 1280494 1280508 1280509 1280518 1280525
1280544 1280546 1280548 1280551 1280576 1280577 1280587 1280589
1280590 1280591 1280592 1280594 1280595 1280596 1280597 1280598
1280599 1280711 1280716 1280717 1280719 1280720 1280726 1280727
1280733 1280758 1280761 1280766 1280786 1280797 1280870 1280872
1280901 1280920 1280923 1280969 1280985 1280993 1281010 1281014
1281025 1281054 1281057 1281077 1281085 1281136 1281201 1281202
1281224 1281226 1281228 1281229 1281231 1281273 1281295 1281297
1281379 1281387 1281399 1281408 1281496 1281514 1281525 1281546
1281597 1281599 1281644 1281645 1281660 1281680 1281682 1281683
1281717 1281732 1281738 1281754 1281777 1281778 1281786 1281789
1281795 1281808 1281825 1281845 1281922 1281955 1281956 1281964
1281973 1281991 1282003 1282013 1282020 1282050 1282054 1282072
1282104 1282110 1282113 1282143 1282147 1282197 1282270 1282271
1282288 1282301 1282509 1282648 1282672 1282747 1282774 1282803
1282808 1282812 1282823 1282881 1282891 1282906 1282975 1282997
1283119 1283130 1283149 1283154 1283163 1283166 1283173 1283176
1283183 1283201 1283203 1283205 1283213 1283230 1283296 1283312
1283328 1283450 1283475 1283479 1283489 1283490 1283517 1283739
1283794 1283795 1283805 1283880 1283906 1283945 1284146 CVE-2023-45853
CVE-2024-10041 CVE-2024-2236 CVE-2024-2312 CVE-2024-56738 CVE-2025-0395
CVE-2025-10911 CVE-2025-11187 CVE-2025-13151 CVE-2025-14104 CVE-2025-15281
CVE-2025-15467 CVE-2025-15468 CVE-2025-15469 CVE-2025-15649 CVE-2025-28162
CVE-2025-28164 CVE-2025-40136 CVE-2025-54770 CVE-2025-54771 CVE-2025-58050
CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664 CVE-2025-64505
CVE-2025-64506 CVE-2025-64720 CVE-2025-65018 CVE-2025-66199 CVE-2025-66293
CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420 CVE-2025-69421
CVE-2025-69720 CVE-2025-8732 CVE-2025-9230 CVE-2025-9231 CVE-2025-9232
CVE-2026-0861 CVE-2026-0915 CVE-2026-0989 CVE-2026-0990 CVE-2026-0992
CVE-2026-100075 CVE-2026-11979 CVE-2026-12087 CVE-2026-13221
CVE-2026-13595 CVE-2026-14456 CVE-2026-14457 CVE-2026-16742 CVE-2026-1757
CVE-2026-18374 CVE-2026-18798 CVE-2026-19499 CVE-2026-19542 CVE-2026-22695
CVE-2026-22795 CVE-2026-22796 CVE-2026-22801 CVE-2026-23199 CVE-2026-23352
CVE-2026-23865 CVE-2026-25646 CVE-2026-2673 CVE-2026-2673 CVE-2026-27171
CVE-2026-27456 CVE-2026-27456 CVE-2026-28387 CVE-2026-28388 CVE-2026-28389
CVE-2026-28390 CVE-2026-29111 CVE-2026-29111 CVE-2026-31789 CVE-2026-31790
CVE-2026-3184 CVE-2026-33416 CVE-2026-33636 CVE-2026-34180 CVE-2026-34181
CVE-2026-34182 CVE-2026-34183 CVE-2026-34743 CVE-2026-34757 CVE-2026-35189
CVE-2026-35191 CVE-2026-40226 CVE-2026-4046 CVE-2026-40467 CVE-2026-40468
CVE-2026-40553 CVE-2026-4105 CVE-2026-4105 CVE-2026-41989 CVE-2026-41990
CVE-2026-41991 CVE-2026-41992 CVE-2026-42250 CVE-2026-42764 CVE-2026-42766
CVE-2026-42767 CVE-2026-42768 CVE-2026-42769 CVE-2026-42770 CVE-2026-43210
CVE-2026-43272 CVE-2026-43409 CVE-2026-4437 CVE-2026-4438 CVE-2026-44604
CVE-2026-44605 CVE-2026-45445 CVE-2026-45446 CVE-2026-45447 CVE-2026-45836
CVE-2026-46044 CVE-2026-46196 CVE-2026-46272 CVE-2026-46675 CVE-2026-4878
CVE-2026-50811 CVE-2026-53377 CVE-2026-53384 CVE-2026-53612 CVE-2026-53613
CVE-2026-53614 CVE-2026-5435 CVE-2026-54369 CVE-2026-54370 CVE-2026-54371
CVE-2026-54411 CVE-2026-5450 CVE-2026-54872 CVE-2026-54874 CVE-2026-54875
CVE-2026-57432 CVE-2026-5928 CVE-2026-5958 CVE-2026-6238 CVE-2026-63072
CVE-2026-63073 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-6368
CVE-2026-63838 CVE-2026-63881 CVE-2026-63913 CVE-2026-63956 CVE-2026-63983
CVE-2026-64009 CVE-2026-64046 CVE-2026-64070 CVE-2026-64132 CVE-2026-64154
CVE-2026-64173 CVE-2026-64205 CVE-2026-64216 CVE-2026-64235 CVE-2026-64297
CVE-2026-64299 CVE-2026-64324 CVE-2026-64372 CVE-2026-64377 CVE-2026-64388
CVE-2026-64402 CVE-2026-64405 CVE-2026-64414 CVE-2026-64418 CVE-2026-64422
CVE-2026-64448 CVE-2026-64457 CVE-2026-64473 CVE-2026-64474 CVE-2026-64475
CVE-2026-64476 CVE-2026-64580 CVE-2026-64594 CVE-2026-64597 CVE-2026-64598
CVE-2026-6732 CVE-2026-6791 CVE-2026-68146 CVE-2026-68162 CVE-2026-68264
CVE-2026-68266 CVE-2026-68290 CVE-2026-68312 CVE-2026-68343 CVE-2026-68367
CVE-2026-68376 CVE-2026-68382 CVE-2026-68385 CVE-2026-68400 CVE-2026-68441
CVE-2026-68451 CVE-2026-68452 CVE-2026-68454 CVE-2026-68471 CVE-2026-68477
CVE-2026-72012 CVE-2026-72018 CVE-2026-72025 CVE-2026-72066 CVE-2026-72070
CVE-2026-72098 CVE-2026-72102 CVE-2026-72128 CVE-2026-72129 CVE-2026-72130
CVE-2026-72147 CVE-2026-72166 CVE-2026-72218 CVE-2026-72219 CVE-2026-72224
CVE-2026-72237 CVE-2026-72247 CVE-2026-72256 CVE-2026-72299 CVE-2026-72321
CVE-2026-72322 CVE-2026-72348 CVE-2026-72349 CVE-2026-72351 CVE-2026-72352
CVE-2026-72383 CVE-2026-72392 CVE-2026-72404 CVE-2026-72406 CVE-2026-72413
CVE-2026-72433 CVE-2026-72434 CVE-2026-72435 CVE-2026-72436 CVE-2026-72444
CVE-2026-72447 CVE-2026-72491 CVE-2026-72897 CVE-2026-7383 CVE-2026-74256
CVE-2026-74257 CVE-2026-74258 CVE-2026-74267 CVE-2026-74268 CVE-2026-74281
CVE-2026-74283 CVE-2026-74288 CVE-2026-74289 CVE-2026-74290 CVE-2026-74330
CVE-2026-74356 CVE-2026-74359 CVE-2026-74365 CVE-2026-74376 CVE-2026-74384
CVE-2026-74385 CVE-2026-74386 CVE-2026-74389 CVE-2026-74391 CVE-2026-74398
CVE-2026-74440 CVE-2026-74449 CVE-2026-74450 CVE-2026-74465 CVE-2026-74467
CVE-2026-74469 CVE-2026-74471 CVE-2026-74473 CVE-2026-74480 CVE-2026-74483
CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74490 CVE-2026-74492
CVE-2026-74493 CVE-2026-74515 CVE-2026-74538 CVE-2026-74564 CVE-2026-74579
CVE-2026-74580 CVE-2026-74586 CVE-2026-74588 CVE-2026-74589 CVE-2026-74590
CVE-2026-74592 CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74600
CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74605 CVE-2026-74606
CVE-2026-74609 CVE-2026-74625 CVE-2026-74628 CVE-2026-74630 CVE-2026-74631
CVE-2026-74632 CVE-2026-74634 CVE-2026-74636 CVE-2026-74637 CVE-2026-74638
CVE-2026-74659 CVE-2026-74660 CVE-2026-74662 CVE-2026-74663 CVE-2026-74666
CVE-2026-74667 CVE-2026-74671 CVE-2026-74688 CVE-2026-74689 CVE-2026-74692
CVE-2026-74694 CVE-2026-74696 CVE-2026-74697 CVE-2026-74700 CVE-2026-74701
CVE-2026-74710 CVE-2026-74713 CVE-2026-74718 CVE-2026-74725 CVE-2026-74726
CVE-2026-74735 CVE-2026-74739 CVE-2026-74745 CVE-2026-74752 CVE-2026-75803
CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-76642 CVE-2026-77117
CVE-2026-77696 CVE-2026-78408 CVE-2026-78410 CVE-2026-80489 CVE-2026-80521
CVE-2026-80585 CVE-2026-80613 CVE-2026-80631 CVE-2026-80664 CVE-2026-80679
CVE-2026-80686 CVE-2026-80694 CVE-2026-80715 CVE-2026-80725 CVE-2026-80747
CVE-2026-80756 CVE-2026-80779 CVE-2026-80789 CVE-2026-80793 CVE-2026-80836
CVE-2026-80840 CVE-2026-80841 CVE-2026-80842 CVE-2026-80844 CVE-2026-80846
CVE-2026-80847 CVE-2026-80848 CVE-2026-80851 CVE-2026-80852 CVE-2026-80863
CVE-2026-80864 CVE-2026-80865 CVE-2026-80880 CVE-2026-80895 CVE-2026-80932
CVE-2026-80976 CVE-2026-80979 CVE-2026-80980 CVE-2026-80983 CVE-2026-80984
CVE-2026-81000 CVE-2026-81001 CVE-2026-8376 CVE-2026-84782 CVE-2026-84784
CVE-2026-86145 CVE-2026-8674 CVE-2026-86805 CVE-2026-89156 CVE-2026-89157
CVE-2026-89158 CVE-2026-89160 CVE-2026-89161 CVE-2026-89162 CVE-2026-89448
CVE-2026-89451 CVE-2026-89453 CVE-2026-89477 CVE-2026-89479 CVE-2026-89480
CVE-2026-89481 CVE-2026-89482 CVE-2026-89485 CVE-2026-89500 CVE-2026-89501
CVE-2026-89502 CVE-2026-89503 CVE-2026-89508 CVE-2026-89510 CVE-2026-89511
CVE-2026-89525 CVE-2026-89526 CVE-2026-89527 CVE-2026-89530 CVE-2026-89531
CVE-2026-89532 CVE-2026-89533 CVE-2026-89534 CVE-2026-89535 CVE-2026-89536
CVE-2026-89538 CVE-2026-89539 CVE-2026-89540 CVE-2026-89541 CVE-2026-89542
CVE-2026-89544 CVE-2026-89545 CVE-2026-89547 CVE-2026-89548 CVE-2026-89550
CVE-2026-89551 CVE-2026-89564 CVE-2026-89569 CVE-2026-89580 CVE-2026-89603
CVE-2026-89644 CVE-2026-89658 CVE-2026-89660 CVE-2026-89662 CVE-2026-89663
CVE-2026-89665 CVE-2026-89669 CVE-2026-89671 CVE-2026-89672 CVE-2026-89673
CVE-2026-89674 CVE-2026-89680 CVE-2026-89683 CVE-2026-89684 CVE-2026-89685
CVE-2026-89686 CVE-2026-89688 CVE-2026-89690 CVE-2026-89691 CVE-2026-89694
CVE-2026-89696 CVE-2026-89697 CVE-2026-89698 CVE-2026-89699 CVE-2026-89702
CVE-2026-89703 CVE-2026-89704 CVE-2026-89705 CVE-2026-89706 CVE-2026-89707
CVE-2026-89710 CVE-2026-89712 CVE-2026-89713 CVE-2026-89747 CVE-2026-89780
CVE-2026-89784 CVE-2026-89789 CVE-2026-89791 CVE-2026-89798 CVE-2026-89912
CVE-2026-89913 CVE-2026-89968 CVE-2026-89970 CVE-2026-89984 CVE-2026-90003
CVE-2026-90065 CVE-2026-90074 CVE-2026-90097 CVE-2026-90101 CVE-2026-90104
CVE-2026-90142 CVE-2026-90149 CVE-2026-90150 CVE-2026-90151 CVE-2026-90177
CVE-2026-90182 CVE-2026-90183 CVE-2026-90203 CVE-2026-90218 CVE-2026-90228
CVE-2026-90240 CVE-2026-90241 CVE-2026-90243 CVE-2026-90259 CVE-2026-90263
CVE-2026-90265 CVE-2026-90292 CVE-2026-90293 CVE-2026-90294 CVE-2026-90307
CVE-2026-90308 CVE-2026-90309 CVE-2026-90358 CVE-2026-90388 CVE-2026-90413
CVE-2026-90414 CVE-2026-90415 CVE-2026-90417 CVE-2026-90426 CVE-2026-90428
CVE-2026-90430 CVE-2026-9076 CVE-2026-92495 CVE-2026-92523 CVE-2026-92525
CVE-2026-93037 CVE-2026-93107 CVE-2026-93108 CVE-2026-93109 CVE-2026-93110
CVE-2026-93154 CVE-2026-93160 CVE-2026-93207 CVE-2026-93212 CVE-2026-93264
CVE-2026-93782 CVE-2026-93794 CVE-2026-93800 CVE-2026-93810 CVE-2026-93814
CVE-2026-93825 CVE-2026-93826 CVE-2026-93827 CVE-2026-93829 CVE-2026-97413
CVE-2026-97421 CVE-2026-97477 CVE-2026-97520 CVE-2026-97521 CVE-2026-97543
CVE-2026-97544 CVE-2026-97545 CVE-2026-97546 CVE-2026-97552 CVE-2026-97557
CVE-2026-97571 CVE-2026-97572 CVE-2026-97573 CVE-2026-97574 CVE-2026-97605
CVE-2026-97902 CVE-2026-97934 CVE-2026-97940 CVE-2026-97947 CVE-2026-97957
CVE-2026-98003 CVE-2026-98028 CVE-2026-98029 CVE-2026-98030 CVE-2026-98091
-----------------------------------------------------------------
The container elemental/base-os-kernel-rt was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 106
Released: Mon Dec 15 13:52:50 2025
Summary: Security update for grub2
Type: security
Severity: important
References: 1234959,1245636,1245738,1245953,1246231,1247242,1249088,1249385,1252930,1252931,1252932,1252933,1252934,1252935,CVE-2024-56738,CVE-2025-54770,CVE-2025-54771,CVE-2025-61661,CVE-2025-61662,CVE-2025-61663,CVE-2025-61664
This update for grub2 fixes the following issues:
Changes in grub2:
- CVE-2025-54771: Fixed grub_file_close() does not properly controls the fs refcount (bsc#1252931)
- CVE-2025-54770: Fixed missing unregister call for net_set_vlan command may lead to use-after-free (bsc#1252930)
- CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free (bsc#1252933)
- CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free (bsc#1252934)
- CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free (bsc#1252935)
- CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)
- Bump upstream SBAT generation to 6
- Fix 'sparse file not allowed' error after grub2-reboot (bsc#1245738)
- Fix PowerPC network boot prefix to correctly locate grub.cfg (bsc#1249385)
- turn off page flipping for i386-pc using VBE video backend (bsc#1245636)
- Fix boot hangs in setting up serial console when ACPI SPCR table is present
and redirection is disabled (bsc#1249088)
- Fix timeout when loading initrd via http after PPC CAS reboot (bsc#1245953)
- Skip mount point in grub_find_device function (bsc#1246231)
- CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grub_crypto_memcmp (bsc#1234959)
-----------------------------------------------------------------
Advisory ID: 107
Released: Mon Dec 15 19:16:15 2025
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1250232,1250233,1250234,CVE-2025-9230,CVE-2025-9231,CVE-2025-9232
This update for openssl-3 fixes the following issues:
- CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
- CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
- CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
-----------------------------------------------------------------
Advisory ID: 109
Released: Tue Dec 16 15:14:02 2025
Summary: Recommended update for freetype2
Type: recommended
Severity: moderate
References:
This update for freetype2 fixes the following issues:
Changes in freetype2:
- update to 2.13.3:
- Do not build the ft2demos flavor in SLE16 where Qt5 will not be
available
-----------------------------------------------------------------
Advisory ID: 131
Released: Mon Jan 12 12:14:46 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1254157,1254158,1254159,1254160,1254480,CVE-2025-64505,CVE-2025-64506,CVE-2025-64720,CVE-2025-65018,CVE-2025-66293
This update for libpng16 fixes the following issues:
- CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices
(bsc#1254157).
- CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit`
enabled (bsc#1254158).
- CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with
`PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159).
- CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced
PNGs with 8-bit output format (bsc#1254160).
- CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial
transparency and gamma correction (bsc#1254480).
-----------------------------------------------------------------
Advisory ID: 162
Released: Thu Jan 22 09:15:08 2026
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: important
References: 1250655,1250664,1253679,1254264,1254928
This update for suse-module-tools fixes the following issues:
- Update to version 16.0.64:
* udev rules: write block queue attributes only if necessary (bsc#1254928)
- Update to version 16.0.63:
* 80-hotplug-cpu-mem.rules: remount tmpfs on 'online' uevents (bsc#1254264)
* udev: use systemd service to remount tmpfs (bsc#1253679)
- Update to version 16.0.62:
* spec file: remove %udev_rules_update call (bsc#1250664)
- Update to version 16.0.61:
* weak-modules2: skip livepatch dir when checking for unresolved symbols (bsc#1250655)
-----------------------------------------------------------------
Advisory ID: 172
Released: Thu Jan 22 15:29:42 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1256525,1256526,CVE-2026-22695,CVE-2026-22801
This update for libpng16 fixes the following issues:
- CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).
- CVE-2026-22801: Fixed integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526).
-----------------------------------------------------------------
Advisory ID: 206
Released: Wed Jan 28 12:26:08 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1248516
This update for grub2 fixes the following issues:
- Optimize PBKDF2 to reduce the decryption time (bsc#1248516)
* lib/crypto: Introduce new HMAC functions to reuse buffers
* lib/pbkdf2: Optimize PBKDF2 by reusing HMAC handle
* kern/misc: Implement faster grub_memcpy() for aligned buffers
-----------------------------------------------------------------
Advisory ID: 218
Released: Thu Jan 29 18:44:57 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1236282,1256436,1256766,1256822,1257005,CVE-2025-0395,CVE-2025-15281,CVE-2026-0861,CVE-2026-0915
This update for glibc fixes the following issues:
Security fixes:
- CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
- CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
- CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
- CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).
Other fixes:
- NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)
-----------------------------------------------------------------
Advisory ID: 237
Released: Mon Feb 2 14:00:02 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1256829,1256830,1256831,1256832,1256833,1256834,1256835,1256836,1256837,1256838,1256839,1256840,1257274,CVE-2025-11187,CVE-2025-15467,CVE-2025-15468,CVE-2025-15469,CVE-2025-66199,CVE-2025-68160,CVE-2025-69418,CVE-2025-69419,CVE-2025-69420,CVE-2025-69421,CVE-2026-22795,CVE-2026-22796
This update for openssl-3 fixes the following issues:
Security fixes:
- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).
- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).
- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).
- CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs >16MB (bsc#1256832).
- CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).
- CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
- CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
- CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
- CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
- CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
- CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
- CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).
Other fixes:
- Enable livepatching support for ppc64le (bsc#1257274).
-----------------------------------------------------------------
Advisory ID: 244
Released: Thu Feb 5 12:26:20 2026
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1256805,CVE-2026-0989
This update for libxml2 fixes the following issues:
- CVE-2026-0989: Fixed call stack exhaustion leading to application crash
due to RelaxNG parser not limiting the recursion depth when
resolving `<include>` directives (bsc#1256805).
-----------------------------------------------------------------
Advisory ID: 252
Released: Wed Feb 11 12:13:17 2026
Summary: Recommended update for systemd
Type: recommended
Severity: important
References: 1228081,1228659,1228728,1231986,1234765,1244449,1248356,1248501,1251981,1254563,1255326,1256427
This update for systemd fixes the following issues:
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
- core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
- Name libsystemd-{shared,core} based on the major version of systemd and the
package release number (bsc#1228081, bsc#1256427)
- systemd-update-helper: clean up the flags immediately after they have been consumed.
- systemd.spec: don't reexecute PID1 on transactional updates.
- Drop most of the workarounds contained in the fixlets.
- Drop %filetriggers build flag. It was introduced to ease backport of Base:System to SLE distros
where file-triggers were unreliable but that is no longer the case on the latest SLE distros.
- Fix: systemd Tainted: unmerged-bin (bsc#1228728, bsc#1251981)
- timer: rebase last_trigger timestamp if needed
- timer: rebase the next elapse timestamp only if timer didn't already run
- main: switch explicitly to tty1 on soft-reboot (bsc#1231986)
- terminal-util: modernize vtnr_from_tty() a bit
- units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
- systemd.spec: use %sysusers_generate_pre so that some systemd users are
already available in %pre (bsc#1248501)
- core/cgroup: Properly handle aborting a pending freeze operation
- detect-virt: add bare-metal support for GCE (bsc#1244449)
- uki.conf is used by the ukify tool to create an Unified Kernel Image[...]
- Make sure that the ordering trick used to update the udev package as close as
as possible to the update of the systemd package also works with zypper.
- Fix: Snapshot 20240730 - unbootable after transactional-update dup (bsc#1228659)
* We also need to add 'Suggests: udev', which serves the same purpose as
'OrderWithRequires: udev' but is part of the repository metadata.
It should therefore hint zypper to install systemd and udev as close together as possible
- Fix systemd-network recommending libidn2-devel (bsc#1234765)
-----------------------------------------------------------------
Advisory ID: 305
Released: Fri Feb 20 16:44:31 2026
Summary: Recommended update for lvm2
Type: recommended
Severity: important
References: 1257661
This update for lvm2 fixes the following issues:
- L3: LVM_SUPPRESS_FD_WARNINGS is no longer effective (bsc#1257661)
* libdaemon: fix suppressing stray fd warnings
-----------------------------------------------------------------
Advisory ID: 310
Released: Thu Feb 26 08:38:22 2026
Summary: Recommended update for openssl-3
Type: recommended
Severity: low
References:
This update for openssl-3 fixes the following issues:
- removed test patches because they are not needed.
-----------------------------------------------------------------
Advisory ID: 314
Released: Thu Feb 26 17:51:31 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References:
This update for gcc15 fixes the following issues:
Update to GCC 15.2 release
* the GCC 15.2 release contains regression fixes accumulated since
the GCC 15.1 release
- Fixes PR120714, RISC-V: incorrect frame pointer CFA address for
stack-clash protection loops
-----------------------------------------------------------------
Advisory ID: 338
Released: Tue Mar 3 09:57:47 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1254299,1254415,1258022
This update for grub2 fixes the following issues:
- Support dm multipath bootlist on PowerPC (bsc#1254415)
- Backport upstream's commit to prevent BIOS assert (bsc#1258022)
- Fix error 'grub-core/script/lexer.c:352:out of memory' after PowerPC CAS Reboot (bsc#1254299)
* Fix PowerPC CAS reboot to evaluate menu context
-----------------------------------------------------------------
Advisory ID: 353
Released: Wed Mar 4 11:51:24 2026
Summary: Security update for libxml2, libxslt
Type: security
Severity: moderate
References: 1247850,1247858,1250553,1256804,1256807,1256808,1256809,1256810,1256811,1256812,1257593,1257594,1257595,CVE-2025-10911,CVE-2025-8732,CVE-2026-0990,CVE-2026-0992,CVE-2026-1757
This update for libxml2, libxslt fixes the following issues:
Changes in libxml2:
- CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in
`xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811).
- CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling
`nextCatalog` elements (bsc#1256809, bsc#1256812).
- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files
(bsc#1247858).
- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257594, bsc#1257595).
- CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)
-----------------------------------------------------------------
Advisory ID: 358
Released: Thu Mar 5 15:21:04 2026
Summary: Recommended update for shim
Type: recommended
Severity: moderate
References: 1205588,1247432,1254336,1254679,CVE-2024-2312
This update for shim fixes the following issues:
This update for shim fixes the following issues:
shim is updated to version 16.1:
- shim_start_image(): fix guid/handle pairing when uninstalling protocols
- Fix uncompressed ipv6 netboot
- fix test segfaults caused by uninitialized memory
- SbatLevel_Variable.txt: minor typo fix.
- Realloc() needs to allocate one more byte for sprintf()
- IPv6: Add more check to avoid multiple double colon and illegal char
- Loader proto v2
- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
- Generate Authenticode for the entire PE file
- README: mention new loader protocol and interaction with UKIs
- shim: change automatically enable MOK_POLICY_REQUIRE_NX
- Save var info
- add SbatLevel entry 2025051000 for PSA-2025-00012-1
- Coverity fixes 20250804
- fix http boot
- Fix double free and leak in the loader protocol
shim is updated to version 16.0:
- Validate that a supplied vendor cert is not in PEM format
- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
- sbat: Also bump latest for grub,4 (and to todays date)
- undo change that limits certificate files to a single file
- shim: don't set second_stage to the empty string
- Fix SBAT.md for today's consensus about numbers
- Update Code of Conduct contact address
- make-certs: Handle missing OpenSSL installation
- Update MokVars.txt
- export DEFINES for sub makefile
- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
- Null-terminate 'arguments' in fallback
- Fix 'Verifiying' typo in error message
- Update Fedora CI targets
- Force gcc to produce DWARF4 so that gdb can use it
- Minor housekeeping 2024121700
- Discard load-options that start with WINDOWS
- Fix the issue that the gBS->LoadImage pointer was empty.
- shim: Allow data after the end of device path node in load options
- Handle network file not found like disks
- Update gnu-efi submodule for EFI_HTTP_ERROR
- Increase EFI file alignment
- avoid EFIv2 runtime services on Apple x86 machines
- Improve shortcut performance when comparing two boolean expressions
- Provide better error message when MokManager is not found
- tpm: Boot with a warning if the event log is full
- MokManager: remove redundant logical constraints
- Test import_mok_state() when MokListRT would be bigger than available size
- test-mok-mirror: minor bug fix
- Fix file system browser hang when enrolling MOK from disk
- Ignore a minor clang-tidy nit
- Allow fallback to default loader when encountering errors on network boot
- test.mk: don't use a temporary random.bin
- pe: Enhance debug report for update_mem_attrs
- Multiple certificate handling improvements
- Generate SbatLevel Metadata from SbatLevel_Variable.txt
- Apply EKU check with compile option
- Add configuration option to boot an alternative 2nd stage
- Loader protocol (with Device Path resolution support)
- netboot cleanup for additional files
- Document how revocations can be delivered
- post-process-pe: add tests to validate NX compliance
- regression: CopyMem() in ad8692e copies out of bounds
- Save the debug and error logs in mok-variables
- Add features for the Host Security ID program
- Mirror some more efi variables to mok-variables
- This adds DXE Services measurements to HSI and uses them for NX
- Add shim's current NX_COMPAT status to HSIStatus
- README.tpm: reflect that vendor_db is in fact logged as 'vendor_db'
- Reject HTTP message with duplicate Content-Length header fields
- Disable log saving
- fallback: don't add new boot order entries backwards
- README.tpm: Update MokList entry to MokListRT
- SBAT Level update for February 2025 GRUB CVEs
-----------------------------------------------------------------
Advisory ID: 396
Released: Tue Mar 17 15:49:10 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1257364,1257365,1258020,CVE-2025-28162,CVE-2025-28164,CVE-2026-25646
This update for libpng16 fixes the following issues:
- CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
- CVE-2025-28162: Fixed a memory leaks when running `pngimage`. (bsc#1257364)
- CVE-2025-28164: Fixed a memory leaks when running `pngimage`. (bsc#1257365)
-----------------------------------------------------------------
Advisory ID: 407
Released: Wed Mar 18 23:55:39 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Fixed bogus expression simplification (bsc#1257463)
-----------------------------------------------------------------
Advisory ID: 480
Released: Tue Apr 7 13:57:38 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1260754,1260755,CVE-2026-33416,CVE-2026-33636
This update for libpng16 fixes the following issues:
- CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code
execution (bsc#1260754).
- CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and
crashes (bsc#1260755).
-----------------------------------------------------------------
Advisory ID: 484
Released: Tue Apr 7 16:33:05 2026
Summary: Security update for libtasn1
Type: security
Severity: moderate
References: 1256341,CVE-2025-13151
This update for libtasn1 fixes the following issues:
- CVE-2025-13151: lack of validation of input data size leads to stack-based buffer overflow in
`asn1_expend_octet_string` (bsc#1256341).
-----------------------------------------------------------------
Advisory ID: 485
Released: Tue Apr 7 17:17:05 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1255326,1258344,1259418,1259650,1259697,CVE-2026-29111,CVE-2026-4105
This update for systemd fixes the following issues:
Update to systemd v257.13:
Security issues:
- CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
- CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
- udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).
Non security issues:
- Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
- Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
Changelog:
- 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
- 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
- 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
- fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
For a complete list of changes, visit:
https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28
-----------------------------------------------------------------
Advisory ID: 502
Released: Thu Apr 9 13:18:30 2026
Summary: Security update for zlib
Type: security
Severity: moderate
References: 1216378,1258392,CVE-2023-45853,CVE-2026-27171
This update for zlib fixes the following issues:
- CVE-2026-27171: Fixed an infinite loop via the crc32_combine64 and crc32_combine_gen64 functions due to missing checks for negative lengths. (bsc#1258392)
- CVE-2023-45853: Fixed an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6. (bsc#1216378)
-----------------------------------------------------------------
Advisory ID: 510
Released: Thu Apr 9 15:00:19 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1222465,1254666,1258859,CVE-2025-14104,CVE-2026-3184
This update for util-linux fixes the following issues:
Security issues:
- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).
Non security issues:
- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).
-----------------------------------------------------------------
Advisory ID: 516
Released: Fri Apr 10 08:36:43 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1258319,1260078,1260082,CVE-2026-4437,CVE-2026-4438
This update for glibc fixes the following issues:
Security fixes:
- CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
- CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).
Other fixes:
- nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).
-----------------------------------------------------------------
Advisory ID: 528
Released: Fri Apr 10 20:29:30 2026
Summary: Security update for pcre2
Type: security
Severity: moderate
References: 1248842,CVE-2025-58050
This update for pcre2 fixes the following issue:
- CVE-2025-58050: integer overflow leads to heap buffer overread in match_ref due to missing boundary restoration in SCS
(bsc#1248842).
-----------------------------------------------------------------
Advisory ID: 544
Released: Mon Apr 13 15:10:32 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: moderate
References: 1252696,1253025
This update for crypto-policies fixes the following issues:
- Fix the testsuite:
* Port all the policy changes to the config files in the test suite.
* Use the newly introduced SKIP_LINTING=1 option.
- Adapt the manpages to SUSE/openSUSE:
* Add crypto policies SUSE manpages
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: (bsc#1253025, bsc#1252696)
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH and MLKEM768-X25519 and SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add crypto policies FIPS output
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
-----------------------------------------------------------------
Advisory ID: 547
Released: Mon Apr 13 17:48:00 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1260441,1260442,1260443,1260444,1260445,1261678,CVE-2026-2673,CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390,CVE-2026-31789,CVE-2026-31790
This update for openssl-3 fixes the following issues:
Security issues fixed:
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).
- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).
- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).
- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with
KeyTransportRecipientInfo (bsc#1261678).
- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).
- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).
Other updates and bugfixes:
- Enable MD2 in legacy provider (jsc#PED-15724).
-----------------------------------------------------------------
Advisory ID: 556
Released: Tue Apr 14 16:33:17 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1232234,CVE-2024-10041
This update for pam fixes the following issue:
- CVE-2024-10041: libpam: vulnerable to read hashed password (bsc#1232234).
-----------------------------------------------------------------
Advisory ID: 574
Released: Thu Apr 16 12:19:06 2026
Summary: Recommended update for update-bootloader
Type: recommended
Severity: moderate
References: 1246013
This update for update-bootloader fixes the following issues:
- Upgrade to version 1.27:
* adjust spec file for immutable mode: switch to using
* systemd-tmpfiles (jsc#PED-14833)
- Upgrade to version 1.26:
* adjust test cases
- Implement config for BLS (bsc#1246013)
-----------------------------------------------------------------
Advisory ID: 585
Released: Fri Apr 17 12:37:59 2026
Summary: Feature update for libgcrypt, libgpg-error
Type: feature
Severity: moderate
References: CVE-2024-2236
This update for libgcrypt, libgpg-error fixes the following issues:
Update libgcrypt to 1.12.1 (jsc#PED-15059):
* New and extended interfaces:
- Allow access to the FIPS service indicator via the new
GCRYCTL_FIPS_SERVICE_INDICATOR control code.
- Make SHA-1 non-FIPS internally for the 1.12 API
- Add Dilithium (ML-DSA) support
- Support optional random-override and support byte string data
* Bug fixes:
- Use secure MPI in _gcry_mpi_assign_limb_space.
- Use CSIDL_COMMON_APPDATA instead of /etc on Windows.
- Apply a Kyber patch from upstream.
- Fix an edge case in Jent initialization.
- mceliece6688128f: Fix stack overflow crash on win64/wine
* Performance:
- Many performance improvements, new AVX512 implementations for modern CPUs.
- Add RISC-V Zbb+Zbc implementation of CRC.
- Add RISC-V vector cryptography implementation of GHASH, AES, SHA256 and SHA512
- Add AVX2 and AVX512 code paths to improve CRC.
For a full changelog, see:
https://dev.gnupg.org/source/libgcrypt/history/master/;libgcrypt-1.12.0
Update libgpg-error to 1.58:
* New src/gpg-error.c (main): New command 'fconcat'.
* Rename src/spawn-posix.c (struct gpgrt_spawn_actions): Rename the field to
ENVP.
* argparse: Use SYSCONFDIR for /etc.
* Update translations for Portugese, German
* src/estream.c (parse_mode): Fix parsing of 'share'. Set sysopen
flag.
* syscfg: Add 64-bit Android arch.
-----------------------------------------------------------------
Advisory ID: 603
Released: Tue Apr 21 11:59:18 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1261957,CVE-2026-34757
This update for libpng16 fixes the following issue:
- CVE-2026-34757: libpng: Information disclosure and data corruption via use-after-free vulnerability (bsc#1261957).
-----------------------------------------------------------------
Advisory ID: 625
Released: Wed Apr 22 12:22:37 2026
Summary: Security update for libcap
Type: security
Severity: important
References: 1261809,CVE-2026-4878
This update for libcap fixes the following issues:
- CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in
`cap_set_file()` (bsc#1261809).
-----------------------------------------------------------------
Advisory ID: 637
Released: Fri Apr 24 12:00:57 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1221126,1259543
This update for grub2 fixes the following issues:
- Fix missing install device check in grub2-install on PowerPC which could lead
to bootlist corruption (bsc#1221126)
* add mandatoryminstallmdevicemcheckmformPowerPC
- Fix double free in xen booting if root filesystem is Btrfs (bsc#1259543)
* btrfs: add ability to boot from subvolumes
* btrfs: get default subvolume
-----------------------------------------------------------------
Advisory ID: 708
Released: Wed May 6 12:44:56 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1261639
This update for libselinux fixes the following issues:
- Backport commit 'libselinux: retain LIFO order for path substitutions' (bsc#1261639)
* otherwise we can not add equivalencies that overload each other in the policy
* libselinux: retain LIFO order for path substitutions
-----------------------------------------------------------------
Advisory ID: 761
Released: Mon May 18 07:38:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1261206,1262464,1262465,CVE-2026-4046,CVE-2026-5450,CVE-2026-5928
This update for glibc fixes the following issues
- CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
- CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
- CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).
-----------------------------------------------------------------
Advisory ID: 803
Released: Tue May 26 14:14:16 2026
Summary: Security update for xz
Type: security
Severity: important
References: 1261280,CVE-2026-34743
This update for xz fixes the following issue
- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
-----------------------------------------------------------------
Advisory ID: 824
Released: Fri May 29 11:59:18 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1258311,1259825,1262315
This update for crypto-policies fixes the following issues:
Changes in crypto-policies:
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy again. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
-----------------------------------------------------------------
Advisory ID: 964
Released: Fri Jun 19 16:14:03 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions from time_t to/from uint32_t.
Filter out -Wtime_t-conversion from flags to build D target library files.
- SUSE-local -Wtime_t-conversion patch added. [jsc#PED-15601]
- Fix for bogus expression simplification [bsc#1257463]
- Enable the use of _dl_find_object even when not available at build time.
[bsc#1253043]
- Fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Fixes PR110812, Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: 1004
Released: Sat Jun 20 20:11:34 2026
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1259924,CVE-2025-69720
This update for ncurses fixes the following issue:
- CVE-2025-69720: buffer overflow in function `analyze_string()`of `progs/infocmp.c` (bsc#1259924).
-----------------------------------------------------------------
Advisory ID: 996
Released: Sat Jun 20 20:17:58 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1232226
This update for libselinux fixes the following issues:
- Backport patch for restorecon to log error on readonly fs (bsc#1232226)
-----------------------------------------------------------------
Advisory ID: 1017
Released: Mon Jun 22 14:26:17 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1266340,1266341,1266342,1266344,1266345,1266347,1266349,1266350,1266351,1266352,1266353,1266355,1266356,1266357,CVE-2026-2673,CVE-2026-34180,CVE-2026-34182,CVE-2026-34183,CVE-2026-42764,CVE-2026-42766,CVE-2026-42767,CVE-2026-42768,CVE-2026-42769,CVE-2026-42770,CVE-2026-45445,CVE-2026-45446,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076
This update for openssl-3 fixes the following issues
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
-----------------------------------------------------------------
Advisory ID: 1036
Released: Mon Jun 22 16:30:37 2026
Summary: Security update for sed
Type: security
Severity: moderate
References: 1262144,CVE-2026-5958
This update for sed fixes the following issue
- CVE-2026-5958: a TOCTOU race can allow to read attacker-controlled content and write it to an unintended file
(bsc#1262144).
-----------------------------------------------------------------
Advisory ID: 1040
Released: Mon Jun 22 16:34:40 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1261606,CVE-2026-27456
This update for util-linux fixes the following issue
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
-----------------------------------------------------------------
Advisory ID: 1047
Released: Mon Jun 22 17:08:34 2026
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1257055
This update for suse-module-tools fixes the following issues:
- Update to version 16.0.65:
* Remove erofs from the list of blacklisted file systems (jsc#PED-14573)
* weak-modules2: don't remove symlinks in the rpm --reinstall case (bsc#1257055)
-----------------------------------------------------------------
Advisory ID: 1060
Released: Wed Jun 24 23:36:29 2026
Summary: Security update for libgcrypt
Type: security
Severity: low
References: 1262693,CVE-2026-41990
This update for libgcrypt fixes the following issue
- CVE-2026-41990: lack of bound check can lead to mishandling of Dilithium signing (bsc#1262693).
-----------------------------------------------------------------
Advisory ID: 1064
Released: Wed Jun 24 23:38:49 2026
Summary: Recommended update for pam
Type: recommended
Severity: moderate
References: 1245524
This update for pam fixes the following issues:
- pam_mkhomedir: building with vendordir option allows fetching skeleton directory
from the vendor directory when creating the user home directory (bsc#1245524)
- disable unix_chkpwd by default, only used as fallback again
- pam_modutil_get*: overwrite password at free
-----------------------------------------------------------------
Advisory ID: 1103
Released: Mon Jun 29 10:05:18 2026
Summary: Recommended update for fuse3
Type: recommended
Severity: moderate
References: 1256466
This update for fuse3 fixes the following issues:
- Add dependency from libfuse3-4 to fusermount3 program (bsc#1256466)
-----------------------------------------------------------------
Advisory ID: 1151
Released: Fri Jul 3 10:55:00 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1245551,1248261,1251948,1254924,1259071,1260357,1261982,1261983,1262305,1263117,1267644,1267647
This update for systemd fixes the following issues:
Changes in systemd:
- Better handle TLS allocation failure (bsc#1254924).
- Disable mounting `debugfs` by default (jsc#PED-8812).
- Import commit 9e8b5afe0fb2061f4a17a3022469dd62f2683960 (bsc#1267647 bsc#1267644 bsc#1262305 bsc#1263117).
- Move `systemd-pcrlock` out from the experimental sub-package to `udev` (bsc#1248261 jsc#PED-15946).
- Add a weak runtime dependency on `libtss2-tcti-device0` (bsc#1260357).
- Import commit 59336000ef7850eba0963c6a690ff3371c425929 (bsc#1261982 bsc#1261983).
- Add a weak runtime dependency on `polkit` (bsc#1259071).
- systemd-update-helper: fix the clean-state command only removing `$STATE_DIR/system` instead of `$STATE_DIR/`.
- systemd-update-helper: add `--root` option for testing convenience.
- systemd-update-helper: fix incorrect skipping of `systemctl disable` during package removal (bsc#1245551).
- systemd-update-helper: fix `do_install_units()` incorrectly returning 1 when no units need preset.
- systemd.spec: introduce `%bcond_without` docs to allow skipping man pages and `devel-doc`.
- systemd.spec: drop the `%{release}` number from the SBAT version (bsc#1251948).
-----------------------------------------------------------------
Advisory ID: 1157
Released: Fri Jul 3 15:19:16 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: 1191
Released: Thu Jul 9 14:39:23 2026
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1270439
This update for systemd fixes the following issues:
Changes in systemd:
- do not make mounting of debugfs optional yet.
-----------------------------------------------------------------
Advisory ID: 1220
Released: Mon Jul 13 09:51:58 2026
Summary: Security update for libxml2
Type: security
Severity: important
References: 1262719,1269790,CVE-2026-11979,CVE-2026-6732
This update for libxml2 fixes the following issues
- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).
- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).
-----------------------------------------------------------------
Advisory ID: 1224
Released: Mon Jul 13 15:54:55 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: 1276
Released: Thu Jul 16 20:48:33 2026
Summary: Security update for freetype2
Type: security
Severity: moderate
References: 1252148,1259118,1271045,CVE-2026-23865,CVE-2026-50811
This update for freetype2 fixes the following issues
- Update to version 2.14.3
- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).
- CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates (bsc#1271045).
-----------------------------------------------------------------
Advisory ID: 1280
Released: Sat Jul 18 10:12:44 2026
Summary: Security update for gzip
Type: security
Severity: important
References: 1269622,CVE-2026-41991
This update for gzip fixes the following issue
- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the
user's PATH (bsc#1269622).
-----------------------------------------------------------------
Advisory ID: 1294
Released: Mon Jul 20 11:26:51 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).
-----------------------------------------------------------------
Advisory ID: 1303
Released: Mon Jul 20 15:44:04 2026
Summary: Security update for gawk
Type: security
Severity: moderate
References: 1271351,1271352,1271354,CVE-2026-40467,CVE-2026-40468,CVE-2026-40553
This update for gawk fixes the following issues:
- CVE-2026-40467: use-after-free vulnerability within the do_getline_redir() routine could lead to a program crash
(bsc#1271351).
- CVE-2026-40468: use-after-free vulnerability in gawk's 'io.c' file could permit heap metadata manipulation and host
memory exhaustion (bsc#1271352).
- CVE-2026-40553: buffer overflow in the ftype() routine of the readdir extension could trigger a program crash
(bsc#1271354).
-----------------------------------------------------------------
Advisory ID: 1317
Released: Wed Jul 22 09:42:13 2026
Summary: Recommended update for shim
Type: recommended
Severity: important
References: 1269084
This update for shim fixes the following issues:
- shim-install: Improve the detection of SL Micro
* The GRUB_DISTRIBUTOR variable in SL Micro images may contain
'SL Micro' or 'SL-Micro' prefix. (bsc#1269084)
-----------------------------------------------------------------
Advisory ID: 1321
Released: Wed Jul 22 10:44:23 2026
Summary: Security update for perl
Type: security
Severity: important
References: 1266304,1266361,1268349,1271372,1271386,CVE-2025-15649,CVE-2026-12087,CVE-2026-13221,CVE-2026-57432,CVE-2026-8376
This update for perl fixes the following issues:
- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date
(bsc#1266361).
- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
(bsc#1266304).
- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure
(bsc#1268349).
- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`
(bsc#1271372).
- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching
(bsc#1271386).
-----------------------------------------------------------------
Advisory ID: 1348
Released: Sat Jul 25 18:36:55 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1271712
This update for openssl-3 fixes the following issue:
- 'HollowByte' DoS via attacker-controlled memory allocation (bsc#1271712).
-----------------------------------------------------------------
Advisory ID: 1390
Released: Wed Jul 29 17:46:03 2026
Summary: Security update for libpng16
Type: security
Severity: important
References:
This update for libpng16 fixes the following issues:
Changes in libpng16:
Version update to 1.6.58 [jsc#PED-16190]
* see CHANGES for other upstream changes
-----------------------------------------------------------------
Advisory ID: 1451
Released: Tue Aug 11 12:14:12 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1259132,1271980
This update for grub2 fixes the following issues:
- Fix crash in booting kernel on some AMD systems (bsc#1271980)
- Add python-base BR
- Fix broken bash completion on arm64 images when the bash-completion package
is not installed (bsc#1259132)
-----------------------------------------------------------------
Advisory ID: 1529
Released: Thu Aug 27 14:47:41 2026
Summary: Security update for gzip
Type: security
Severity: moderate
References: 1269623,1272554,CVE-2026-41992
This update for gzip fixes the following issues:
- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state
between different decompression formats within a single execution (bsc#1269623, bsc#1272554).
-----------------------------------------------------------------
Advisory ID: 1538
Released: Sun Aug 30 16:33:19 2026
Summary: Recommended update for update-bootloader
Type: recommended
Severity: moderate
References: 1271602
This update for update-bootloader fixes the following issues:
- update to version 1.28:
* fix test suite
* add test case
* adjust two tests
* updated test results
* fix command line parser (bsc#1271602)
* fix and reenable ksh tests: ksh uses alts now
* update ksh test results
-----------------------------------------------------------------
Advisory ID: 1562
Released: Mon Aug 31 07:56:37 2026
Summary: Security update for libgpg-error
Type: security
Severity: moderate
References: 1263078
This update for libgpg-error fixes the following issue:
- Out-of-bounds read in `_gpgrt_vfnameconcat` of `stringutils.c` when the `GPGRT_FCONCAT_SYSCONF` flag is used
(bsc#1263078).
-----------------------------------------------------------------
Advisory ID: 1573
Released: Mon Aug 31 22:36:28 2026
Summary: Recommended update for gcc16
Type: recommended
Severity: moderate
References: 1272616
This update for gcc16 fixes the following issues:
gcc16 is shipped as new package.
This update ships the GNU Compiler Collection GCC 16.2.
The compiler runtime libraries are provided for SUSE Linux Enterprise 16.0
versions and replace the same named GCC 14 ones.
The new compilers are provided in the PackageHub 16.0 only.
To use gcc16 compilers use:
- install 'gcc16' or 'gcc16-c++' or one of the other 'gcc16-COMPILER' frontend packages.
- override your Makefile to use CC=gcc16, CXX=g++16 and similar overrides for the other languages.
For a full changelog with all new GCC16 features, check out
https://gcc.gnu.org/gcc-16/changes.html
- Update to GCC 16.2 release (gcc-16.2.0+git9497)
* accumulated bugfixes from the gcc-16 release branch
- Disable multilibs for cross-x86_64-gcc
-----------------------------------------------------------------
Advisory ID: 1592
Released: Wed Sep 2 17:55:21 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: 1602
Released: Thu Sep 3 22:41:28 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1237515,1254924,1259418,1259650,1261400,1271444,CVE-2026-16742,CVE-2026-29111,CVE-2026-40226,CVE-2026-4105
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742: `systemd-homed`: local privilege escalation due to missing home record signature verification on
the authentication path (bsc#1271444).
Non security issue fixed:
- `systemd-resolved` fails to start due to write access to `tmpfs` denied (bsc#1237515).
-----------------------------------------------------------------
Advisory ID: 1610
Released: Fri Sep 4 15:48:44 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: 1661
Released: Fri Sep 11 13:45:57 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
-----------------------------------------------------------------
Advisory ID: 1688
Released: Wed Sep 16 16:28:22 2026
Summary: Security update for rpm
Type: security
Severity: important
References: 1218459,1253139,1259215,1268747,1269150,1269571,1269584,CVE-2026-44604,CVE-2026-44605
This update for rpm fixes the following issues:
Changes in rpm:
- split imaevmsign plugin into a multibuild flavor
Changes in rpm:
- Add Requires: (rpm-plugin-selinux if selinux-policy)
- harden ndb code [bsc#1269584] [CVE-2026-44605]
- split all plugins into subpackages
* this allows for an easy way to get rid of a plugin, it's also
what other distributions do
- make the imaevmsign plugin build in a multibuild flavor
- rpm2archive: use size 0 for hardlinked files as bnew versions of
gnu tar reject non-zero sizes [bsc#1269150]
- backport fix for add_sysuser macro [bsc#1269571]
- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]
- switch from rpmpgp_legacy to libpgpr
* multiple bug fixes, support for v5 and v6 signatures
- turn on imaevm file signature support and move the imaevm code
that needs the libimaevm library into a plugin. Put this
plugin into a new 'rpm-imaevmsign' subpackage. [jsc#PED-7246]
- Fix 'unexpected EOF' when using rpmbuild to install ELF binaries
due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)
- Remove /var/lib/rpm migration scripting, retain an error if old
location is found
- Use systemd-tmpfiles to create & maintain /var/lib/rpm symlink
(boo#1253139)
- flush scriptlet notification messages in --runposttrans
* needed to fix leaking tmp files [bsc#1218459]
* added 'rpm_flushes_runposttrans' provides for libzypp
-----------------------------------------------------------------
Advisory ID: 1707
Released: Fri Sep 18 18:31:02 2026
Summary: Recommended update for gcc15, gcc16
Type: recommended
Severity: critical
References: 1277919
This update for gcc15, gcc16 fixes the following issues:
Changes in gcc15:
- Rebuild to rename library packages after the switch to gcc16
libraries.
Changes in gcc16:
- Fix build reproducability when PCH is used.
- Fix auto-detection of Zen6 [bsc#1277919]
- Remove support for s390 (32bit), make sure to configure s390x with
--disable-multilib to avoid configury error without explicit
disable of multilibs. Support for s390 is officially deprecated.
-----------------------------------------------------------------
Advisory ID: 1733
Released: Tue Sep 22 09:23:33 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1261606,1268886,1269583,1270219,1275441,1278347,1278348,1278349,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614,CVE-2026-76642,CVE-2026-78408,CVE-2026-78410
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).
- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).
- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec
Bypass in SUID mount(8) (bsc#1268886).
- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege
escalation (bsc#1278349).
- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or
termination of root processes (bsc#1278348).
- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`
redirection (bsc#1278347).
Changes for util-linux:
- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)
- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
- lib/fileutils: fix unused parameter warnings without SYS_openat2
- libmount: add missing fileutils.h include to hook_idmap.c
- libmount: add mnt_open_tree() helper for safe tree opening
- libmount: pin source path with openat2() for restricted users
(bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: restrict source path canonicalization for non-root
users (bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: skip post-mount hooks after failed mount helper
(bsc#1275441, bsc#1278349, CVE-2026-76642)
- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
- nsenter: close cgroup.procs fd after join to prevent authority
leak (bsc#1275441, bsc#1278348, CVE-2026-78408)
- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,
bsc#1278348, CVE-2026-78408)
- wall, write: sanitize hostname in banner header (bsc#1275441)
- Add missing function. (bsc#1275441)
- ipcutils: Prevent using uninitialized variable (bsc#1268886)
- BREAKING CHANGE:
Paths must always be canonicalized for unprivileged users to
ensure safe target resolution. X-mount.nocanonicalize is ignored
for them.
- INCOMAPTIBLE CHANGE (linux < 6.15):
X-mount.subdir: The safe detached subdirectory is no more
supported for unprivileged users for safety reasons.
- liblastlog2: Wait on busy SQLite connections (bsc#1268886).
- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root
(bsc#1268886).
- libblkid: Fix use-after-free in nested partition probing
(bsc#1269583, bsc#1268886, CVE-2026-13595)
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy
mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).
- fileutils: add ul_open_no_symlinks() needed by other patches
(bsc#1268886).
- libmount: add fd_target to context for TOCTOU race condition
prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).
- libmount: ignore X-mount.nocanonicalize for restricted users
- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,
CVE-2026-53612, GHSA-g8wm-75wr-g2vh).
- libmount: restrict X-mount.subdir for non-root (bsc#1268886).
- libmount: use fd_target in hook_idmap for move_mount()
- libmount: add mount ID verification and man page TOCTOU note
- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
(bsc#1268886#c2, bsc#1261606).
- Ignore pam-config error that prevents update failure if common*
pam configuration is not symlink to common-*-pc (bsc#1270219).
-----------------------------------------------------------------
Advisory ID: 1747
Released: Wed Sep 23 21:42:24 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).
-----------------------------------------------------------------
Advisory ID: 1769
Released: Tue Sep 29 14:25:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
(bsc#1282509).
Other changes:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: 1792
Released: Wed Sep 30 17:02:45 2026
Summary: Recommended update for jitterentropy
Type: recommended
Severity: moderate
References: 1282301
This update for jitterentropy fixes the following issues:
Changes in jitterentropy:
- OSR has to be at least 5 according to current reviews. (bsc#1282301)
-----------------------------------------------------------------
Advisory ID: 1849
Released: Tue Oct 6 15:07:44 2026
Summary: Recommended update for grub2
Type: recommended
Severity: moderate
References: 1278729
This update for grub2 fixes the following issues:
Changes in grub2:
- Add SBAT Provides to support shim SBAT dependency checks (bsc#1278729)
-----------------------------------------------------------------
Advisory ID: 1897
Released: Sat Oct 10 13:21:45 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1283183,CVE-2026-46675
This update for libpng16 fixes the following issue:
- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression
(bsc#1283183).
Changes for libpng16:
- version update to 1.6.59:
* Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<JasonHonKL at users.noreply.github.com>.)
* Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
* Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
* Applied fixes and updates to the CMake build.
* Adopted the REUSE Specification for licensing the CI files.
-----------------------------------------------------------------
Advisory ID: 1904
Released: Mon Oct 12 15:51:59 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1253340,1258335,1260474,1261564,1261816,1264330,1264607,1264747,1266410,1266848,1267464,1267672,1271817,1271901,1271950,1272145,1272215,1272347,1272388,1272473,1272571,1272802,1272803,1272890,1273040,1273059,1273116,1273258,1273275,1273290,1273297,1273320,1273491,1273512,1273784,1273879,1273889,1273938,1273970,1273976,1273982,1274037,1274061,1274245,1274297,1274298,1274316,1274319,1274538,1274629,1274663,1274776,1274818,1274824,1274836,1274890,1274912,1274920,1275137,1275142,1275170,1275495,1275543,1275545,1275549,1275559,1275567,1275682,1275740,1275924,1275953,1275972,1275977,1276007,1276009,1276262,1276287,1276295,1276337,1276338,1276340,1276345,1276347,1276349,1276352,1276353,1276388,1276460,1276461,1276462,1276474,1276475,1276504,1276508,1276519,1276532,1276535,1276538,1276563,1276565,1276570,1276573,1276579,1276783,1276852,1276921,1276923,1276927,1276930,1276947,1277030,1277032,1277036,1277098,1277101,1277109,1277122,1277128,1277129,1277143,1277149,1277153,1277215,1
277217,1277218,1277234,1277245,1277272,1277277,1277296,1277314,1277342,1277371,1277372,1277374,1277379,1277382,1277392,1277396,1277401,1277405,1277410,1277452,1277489,1277493,1277555,1277556,1277557,1277558,1277568,1277615,1277625,1277626,1277640,1277662,1277674,1277705,1277766,1277781,1277784,1277792,1277801,1277805,1277820,1277823,1277824,1277840,1277843,1277844,1277857,1277864,1277885,1277892,1277895,1277896,1277897,1277900,1277904,1277906,1277910,1277913,1277915,1278031,1278035,1278053,1278054,1278056,1278063,1278067,1278087,1278091,1278100,1278191,1278195,1278199,1278205,1278215,1278216,1278225,1278245,1278247,1278255,1278311,1278314,1278315,1278363,1278708,1279116,1279497,1279525,1279527,1279532,1279535,1279536,1279569,1279581,1279590,1279621,1279702,1279786,1279799,1279819,1279835,1279850,1279875,1279878,1279888,1280143,1280146,1280148,1280151,1280163,1280166,1280171,1280178,1280179,1280184,1280193,1280206,1280235,1280237,1280243,1280251,1280252,1280263,1280296,1280298,128029
9,1280303,1280309,1280333,1280334,1280335,1280336,1280338,1280350,1280375,1280379,1280383,1280384,1280387,1280388,1280449,1280451,1280455,1280456,1280464,1280468,1280477,1280487,1280488,1280490,1280494,1280508,1280509,1280518,1280525,1280544,1280546,1280548,1280551,1280576,1280577,1280711,1280716,1280717,1280719,1280720,1280726,1280727,1280733,1280758,1280761,1280766,1280786,1280797,1280870,1280872,1280901,1280920,1280923,1280969,1280985,1280993,1281010,1281014,1281025,1281054,1281057,1281077,1281085,1281136,1281201,1281202,1281224,1281226,1281228,1281229,1281231,1281273,1281295,1281379,1281387,1281399,1281408,1281496,1281514,1281525,1281546,1281597,1281599,1281644,1281645,1281660,1281680,1281682,1281683,1281717,1281732,1281738,1281754,1281777,1281778,1281786,1281789,1281795,1281808,1281825,1281845,1281922,1281955,1281956,1281964,1281973,1281991,1282003,1282013,1282020,1282050,1282054,1282072,1282104,1282110,1282113,1282143,1282147,1282197,1282270,1282271,1282288,1282648,1282672,128
2747,1282774,1282803,1282808,1282812,1282823,1282881,1282891,1282906,1282975,1282997,1283119,1283130,1283149,1283154,1283163,1283166,1283173,1283176,1283201,1283203,1283205,1283213,1283230,1283296,1283312,1283328,1283450,1283475,1283479,1283489,1283490,1283517,1283739,1283794,1283795,1283805,1283880,1283906,1283945,1284146,CVE-2025-40136,CVE-2026-100075,CVE-2026-23199,CVE-2026-23352,CVE-2026-43210,CVE-2026-43272,CVE-2026-43409,CVE-2026-45836,CVE-2026-46044,CVE-2026-46196,CVE-2026-46272,CVE-2026-53377,CVE-2026-53384,CVE-2026-63838,CVE-2026-63881,CVE-2026-63913,CVE-2026-63956,CVE-2026-63983,CVE-2026-64009,CVE-2026-64046,CVE-2026-64070,CVE-2026-64132,CVE-2026-64154,CVE-2026-64173,CVE-2026-64205,CVE-2026-64216,CVE-2026-64235,CVE-2026-64297,CVE-2026-64299,CVE-2026-64324,CVE-2026-64372,CVE-2026-64377,CVE-2026-64388,CVE-2026-64402,CVE-2026-64405,CVE-2026-64414,CVE-2026-64418,CVE-2026-64422,CVE-2026-64448,CVE-2026-64457,CVE-2026-64473,CVE-2026-64474,CVE-2026-64475,CVE-2026-64476,CVE-2026-64
580,CVE-2026-64594,CVE-2026-64597,CVE-2026-64598,CVE-2026-68146,CVE-2026-68162,CVE-2026-68264,CVE-2026-68266,CVE-2026-68290,CVE-2026-68312,CVE-2026-68343,CVE-2026-68367,CVE-2026-68376,CVE-2026-68382,CVE-2026-68385,CVE-2026-68400,CVE-2026-68441,CVE-2026-68451,CVE-2026-68452,CVE-2026-68454,CVE-2026-68471,CVE-2026-68477,CVE-2026-72012,CVE-2026-72018,CVE-2026-72025,CVE-2026-72066,CVE-2026-72070,CVE-2026-72098,CVE-2026-72102,CVE-2026-72128,CVE-2026-72129,CVE-2026-72130,CVE-2026-72147,CVE-2026-72166,CVE-2026-72218,CVE-2026-72219,CVE-2026-72224,CVE-2026-72237,CVE-2026-72247,CVE-2026-72256,CVE-2026-72299,CVE-2026-72321,CVE-2026-72322,CVE-2026-72348,CVE-2026-72349,CVE-2026-72351,CVE-2026-72352,CVE-2026-72383,CVE-2026-72392,CVE-2026-72404,CVE-2026-72406,CVE-2026-72413,CVE-2026-72433,CVE-2026-72434,CVE-2026-72435,CVE-2026-72436,CVE-2026-72444,CVE-2026-72447,CVE-2026-72491,CVE-2026-74256,CVE-2026-74257,CVE-2026-74258,CVE-2026-74267,CVE-2026-74268,CVE-2026-74281,CVE-2026-74283,CVE-2026-74288,CVE
-2026-74289,CVE-2026-74290,CVE-2026-74330,CVE-2026-74356,CVE-2026-74359,CVE-2026-74365,CVE-2026-74376,CVE-2026-74384,CVE-2026-74385,CVE-2026-74386,CVE-2026-74389,CVE-2026-74391,CVE-2026-74398,CVE-2026-74440,CVE-2026-74449,CVE-2026-74450,CVE-2026-74465,CVE-2026-74467,CVE-2026-74469,CVE-2026-74471,CVE-2026-74473,CVE-2026-74480,CVE-2026-74483,CVE-2026-74484,CVE-2026-74485,CVE-2026-74487,CVE-2026-74490,CVE-2026-74492,CVE-2026-74493,CVE-2026-74515,CVE-2026-74538,CVE-2026-74564,CVE-2026-74579,CVE-2026-74580,CVE-2026-74586,CVE-2026-74588,CVE-2026-74589,CVE-2026-74590,CVE-2026-74592,CVE-2026-74594,CVE-2026-74595,CVE-2026-74597,CVE-2026-74600,CVE-2026-74601,CVE-2026-74602,CVE-2026-74603,CVE-2026-74605,CVE-2026-74606,CVE-2026-74609,CVE-2026-74625,CVE-2026-74628,CVE-2026-74630,CVE-2026-74631,CVE-2026-74632,CVE-2026-74634,CVE-2026-74636,CVE-2026-74637,CVE-2026-74638,CVE-2026-74659,CVE-2026-74660,CVE-2026-74662,CVE-2026-74663,CVE-2026-74666,CVE-2026-74667,CVE-2026-74671,CVE-2026-74688,CVE-2026-7
4689,CVE-2026-74692,CVE-2026-74694,CVE-2026-74696,CVE-2026-74697,CVE-2026-74700,CVE-2026-74701,CVE-2026-74710,CVE-2026-74713,CVE-2026-74718,CVE-2026-74725,CVE-2026-74726,CVE-2026-74735,CVE-2026-74739,CVE-2026-74745,CVE-2026-74752,CVE-2026-80521,CVE-2026-80585,CVE-2026-80613,CVE-2026-80631,CVE-2026-80664,CVE-2026-80679,CVE-2026-80686,CVE-2026-80694,CVE-2026-80715,CVE-2026-80725,CVE-2026-80747,CVE-2026-80756,CVE-2026-80779,CVE-2026-80789,CVE-2026-80793,CVE-2026-80836,CVE-2026-80840,CVE-2026-80841,CVE-2026-80842,CVE-2026-80844,CVE-2026-80846,CVE-2026-80847,CVE-2026-80848,CVE-2026-80851,CVE-2026-80852,CVE-2026-80863,CVE-2026-80864,CVE-2026-80865,CVE-2026-80880,CVE-2026-80895,CVE-2026-80932,CVE-2026-80976,CVE-2026-80979,CVE-2026-80980,CVE-2026-80983,CVE-2026-80984,CVE-2026-81000,CVE-2026-81001,CVE-2026-89448,CVE-2026-89451,CVE-2026-89453,CVE-2026-89477,CVE-2026-89479,CVE-2026-89480,CVE-2026-89481,CVE-2026-89482,CVE-2026-89485,CVE-2026-89500,CVE-2026-89501,CVE-2026-89502,CVE-2026-89503,CV
E-2026-89508,CVE-2026-89510,CVE-2026-89511,CVE-2026-89525,CVE-2026-89526,CVE-2026-89527,CVE-2026-89530,CVE-2026-89531,CVE-2026-89532,CVE-2026-89533,CVE-2026-89534,CVE-2026-89535,CVE-2026-89536,CVE-2026-89538,CVE-2026-89539,CVE-2026-89540,CVE-2026-89541,CVE-2026-89542,CVE-2026-89544,CVE-2026-89545,CVE-2026-89547,CVE-2026-89548,CVE-2026-89550,CVE-2026-89551,CVE-2026-89564,CVE-2026-89569,CVE-2026-89580,CVE-2026-89603,CVE-2026-89644,CVE-2026-89658,CVE-2026-89660,CVE-2026-89662,CVE-2026-89663,CVE-2026-89665,CVE-2026-89669,CVE-2026-89671,CVE-2026-89672,CVE-2026-89673,CVE-2026-89674,CVE-2026-89680,CVE-2026-89683,CVE-2026-89684,CVE-2026-89685,CVE-2026-89686,CVE-2026-89688,CVE-2026-89690,CVE-2026-89691,CVE-2026-89694,CVE-2026-89696,CVE-2026-89697,CVE-2026-89698,CVE-2026-89699,CVE-2026-89702,CVE-2026-89703,CVE-2026-89704,CVE-2026-89705,CVE-2026-89706,CVE-2026-89707,CVE-2026-89710,CVE-2026-89712,CVE-2026-89713,CVE-2026-89747,CVE-2026-89780,CVE-2026-89784,CVE-2026-89789,CVE-2026-89791,CVE-2026-
89798,CVE-2026-89912,CVE-2026-89913,CVE-2026-89968,CVE-2026-89970,CVE-2026-89984,CVE-2026-90003,CVE-2026-90065,CVE-2026-90074,CVE-2026-90097,CVE-2026-90101,CVE-2026-90104,CVE-2026-90142,CVE-2026-90149,CVE-2026-90150,CVE-2026-90151,CVE-2026-90177,CVE-2026-90182,CVE-2026-90183,CVE-2026-90203,CVE-2026-90218,CVE-2026-90228,CVE-2026-90240,CVE-2026-90241,CVE-2026-90243,CVE-2026-90259,CVE-2026-90263,CVE-2026-90265,CVE-2026-90292,CVE-2026-90293,CVE-2026-90294,CVE-2026-90307,CVE-2026-90308,CVE-2026-90309,CVE-2026-90358,CVE-2026-90388,CVE-2026-90413,CVE-2026-90414,CVE-2026-90415,CVE-2026-90417,CVE-2026-90426,CVE-2026-90428,CVE-2026-90430,CVE-2026-92495,CVE-2026-92523,CVE-2026-92525,CVE-2026-93037,CVE-2026-93107,CVE-2026-93108,CVE-2026-93109,CVE-2026-93110,CVE-2026-93154,CVE-2026-93160,CVE-2026-93207,CVE-2026-93212,CVE-2026-93264,CVE-2026-93782,CVE-2026-93794,CVE-2026-93800,CVE-2026-93810,CVE-2026-93814,CVE-2026-93825,CVE-2026-93826,CVE-2026-93827,CVE-2026-93829,CVE-2026-97413,CVE-2026-97421,C
VE-2026-97477,CVE-2026-97520,CVE-2026-97521,CVE-2026-97543,CVE-2026-97544,CVE-2026-97545,CVE-2026-97546,CVE-2026-97552,CVE-2026-97557,CVE-2026-97571,CVE-2026-97572,CVE-2026-97573,CVE-2026-97574,CVE-2026-97605,CVE-2026-97902,CVE-2026-97934,CVE-2026-97940,CVE-2026-97947,CVE-2026-97957,CVE-2026-98003,CVE-2026-98028,CVE-2026-98029,CVE-2026-98030,CVE-2026-98091
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
(bsc#1272890).
- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
- CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).
- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).
- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).
- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).
- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).
- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).
- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).
- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).
- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).
- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).
- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).
- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).
- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).
- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).
- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).
- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).
- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).
- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).
- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).
- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).
- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).
- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).
- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).
- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).
- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).
- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).
- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).
- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).
- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).
- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).
- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).
- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).
- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).
- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).
- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).
- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).
- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).
- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).
- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).
- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).
- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).
- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).
- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).
- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).
- CVE-2026-72491: net/9p: fix race condition on rdma->state in trans_rdma.c (bsc#1276947).
- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).
- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).
- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).
- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
(bsc#1276519).
- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).
- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).
- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).
- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).
- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).
- CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).
- CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067).
- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).
- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).
- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).
- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).
- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).
- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).
- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).
- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).
- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).
- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).
- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).
- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).
- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).
- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).
- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).
- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).
- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).
- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).
- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).
- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).
- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).
- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).
- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
- CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).
- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).
- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).
- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).
- CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).
- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).
- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).
- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).
- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).
- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).
- CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).
- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).
- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).
- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).
- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).
- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).
- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).
- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).
- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).
- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).
- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).
- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).
- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).
- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).
- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).
- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).
- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).
- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).
- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).
- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).
- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).
- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).
- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).
- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).
- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).
- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).
- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).
- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).
- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).
- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).
- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).
- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).
- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).
- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).
- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).
- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).
- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).
- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).
- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).
- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).
- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).
- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).
- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).
- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).
- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).
- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).
- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).
- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).
- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).
- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).
- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).
- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).
- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).
- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).
- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).
- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).
- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).
- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).
- CVE-2026-89451: iommu/sva: Set handle->dev before the SVA handle is visible (bsc#1280383).
- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).
- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).
- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).
- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).
- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).
- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).
- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).
- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).
- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).
- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).
- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).
- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).
- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).
- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).
- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).
- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).
- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).
- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).
- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).
- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).
- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).
- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).
- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).
- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).
- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).
- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).
- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).
- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).
- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).
- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).
- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).
- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).
- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).
- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).
- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).
- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).
- CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask (bsc#1280252).
- CVE-2026-89672: nfsd: gate nfs2 setacl by argp->mask (bsc#1280235).
- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).
- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).
- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).
- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).
- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).
- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).
- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).
- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).
- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).
- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).
- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).
- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).
- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).
- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).
- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).
- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).
- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).
- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).
- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).
- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).
- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).
- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).
- CVE-2026-89780: net: qualcomm: rmnet: restore skb->dev on deaggregated frames (bsc#1280969).
- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).
- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).
- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).
- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).
- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).
- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).
- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).
- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).
- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).
- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).
- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).
- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).
- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).
- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).
- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).
- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).
- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).
- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).
- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).
- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).
- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).
- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).
- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).
- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).
- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).
- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).
- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).
- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).
- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).
- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).
- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).
- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).
- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).
- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).
- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).
- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).
- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).
- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).
- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).
- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).
- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270).
- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).
- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).
- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).
- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).
- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).
- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).
- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).
- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).
- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).
- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).
- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).
- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).
- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.
- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().
- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).
- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).
- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).
- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).
- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).
- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).
- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).
- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).
- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).
- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).
- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).
- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).
- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).
- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).
- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).
- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).
- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).
- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).
- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).
- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).
- CVE-2026-97934: tracing: Fix memory corruption from a 'STACKTRACE' histogram key (bsc#1282997).
- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).
- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).
- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).
- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).
- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).
- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).
- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).
- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).
- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).
The following non security issues were fixed:
- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).
- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).
- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).
- ACPICA: add boundary checks in two places (stable-fixes).
- ACPICA: Add package limit checks in parser functions (stable-fixes).
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).
- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).
- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).
- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).
- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).
- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).
- ACPICA: Prevent adding invalid references (stable-fixes).
- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).
- ACPICA: validate handler object type in two places (stable-fixes).
- ALSA: 6fire: Clean ups with guard() (stable-fixes).
- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).
- ALSA: aloop: Check card index validity at probe (stable-fixes).
- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).
- ALSA: caiaq: unregister the input device when probe fails (git-fixes).
- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).
- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).
- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).
- ALSA: es18xx: check control allocation before private data setup (stable-fixes).
- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).
- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).
- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).
- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).
- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).
- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).
- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).
- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).
- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).
- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).
- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).
- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).
- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).
- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).
- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).
- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).
- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).
- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).
- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).
- ALSA: line6: reject oversized playback packets (git-fixes).
- ALSA: mpu401: Check card index validity at probe (stable-fixes).
- ALSA: mts64: Check card index validity at probe (stable-fixes).
- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).
- ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes).
- ALSA: portman2x4: Check card index validity at probe (stable-fixes).
- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).
- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).
- ALSA: seq: Serialize compat port-info ioctls (git-fixes).
- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).
- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).
- ALSA: ump: Copy FB name string more safely (stable-fixes).
- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).
- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).
- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).
- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).
- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).
- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).
- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).
- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).
- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).
- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).
- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).
- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).
- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).
- ALSA: virmidi: Check card index validity at probe (stable-fixes).
- ALSA: virtio: reset device before deleting virtqueues (git-fixes).
- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).
- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).
- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).
- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
- arm64: percpu: Fix this_cpu_write() casting (git-fixes).
- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).
- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).
- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).
- ASoC: codecs: aw88261: reduce log spam (stable-fixes).
- ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes).
- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).
- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).
- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).
- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).
- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes).
- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (git-fixes).
- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).
- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).
- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).
- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).
- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).
- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).
- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).
- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).
- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).
- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).
- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).
- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).
- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).
- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).
- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).
- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).
- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).
- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).
- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).
- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).
- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).
- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).
- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).
- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).
- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).
- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).
- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).
- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).
- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).
- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).
- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).
- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).
- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).
- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).
- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).
- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).
- Bluetooth: eir: validate service data length before reading UUID (git-fixes).
- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).
- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).
- Bluetooth: hci_core: Print number of packets in conn->data_q (stable-fixes).
- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).
- Bluetooth: hci_sock: validate event length before filtering (git-fixes).
- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).
- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).
- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).
- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).
- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).
- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).
- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).
- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).
- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).
- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).
- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes).
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).
- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).
- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).
- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).
- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).
- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).
- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).
- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).
- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).
- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).
- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).
- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default
configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
- dmaengine: Add devm_dma_request_chan() (stable-fixes).
- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).
- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).
- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).
- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).
- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).
- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).
- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).
- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).
- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).
- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).
- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).
- driver core: Export get_dev_from_fwnode() (stable-fixes).
- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).
- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).
- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).
- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).
- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).
- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).
- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).
- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).
- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).
- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).
- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).
- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).
- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).
- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).
- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).
- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).
- drm/amdgpu: check ras and obj before dereference (git-fixes).
- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).
- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).
- drm/amdgpu: Failed to check various return code (stable-fixes).
- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).
- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).
- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).
- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).
- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).
- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).
- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).
- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).
- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).
- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).
- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).
- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).
- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).
- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).
- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes).
- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).
- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).
- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).
- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).
- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).
- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).
- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).
- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).
- drm/cirrus: Use video aperture helpers (stable-fixes).
- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).
- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).
- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).
- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).
- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).
- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).
- drm/i915: fix incorrect RCU teardown order (git-fixes).
- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).
- drm/imagination: clamp freelist reconstruction requests (git-fixes).
- drm/imagination: Fix page count for page table for map() interface (git-fixes).
- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).
- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).
- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).
- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).
- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).
- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).
- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).
- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).
- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).
- drm/msm: Recover HW before retire hung submit (git-fixes).
- drm/nouveau/bios: skip the IFR header if present (stable-fixes).
- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).
- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).
- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).
- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).
- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).
- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).
- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).
- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).
- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).
- drm/omap: dsi: Do not copy isr table (git-fixes).
- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).
- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).
- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).
- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).
- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).
- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).
- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).
- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).
- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).
- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).
- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).
- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).
- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).
- drm: add drm_memory_stats_is_zero (stable-fixes).
- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).
- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).
- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).
- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).
- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).
- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).
- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).
- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).
- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).
- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).
- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).
- gpio: pisosr: Read 'ngpios' as u32 (stable-fixes).
- gpio: tps65219: Fix GPIO input value reads (git-fixes).
- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).
- gpio: zynq: fix runtime PM leak on request error path (git-fixes).
- HID: alps: fix use-after-free on input2 registration failure (git-fixes).
- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).
- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).
- HID: asus: fortify keyboard handshake (stable-fixes).
- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).
- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).
- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).
- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).
- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).
- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).
- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).
- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).
- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).
- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).
- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).
- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).
- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).
- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).
- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).
- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).
- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).
- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).
- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).
- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).
- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).
- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).
- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).
- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).
- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).
- hwmon: (w83793) release probe data through kref (git-fixes).
- i2c: at91: release DMA channels on remove and probe error (git-fixes).
- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).
- i2c: imx: disable autosuspend on remove (git-fixes).
- i2c: imx: release DMA channels on probe error (git-fixes).
- i2c: mxs: fix DMA channel leak on probe error (git-fixes).
- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).
- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).
- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).
- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).
- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).
- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).
- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).
- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).
- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).
- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).
- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).
- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).
- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).
- iio: accel: sca3000: fix frequency divider condition check (git-fixes).
- iio: adc: pac1934: check ACPI label duplication (git-fixes).
- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).
- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).
- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).
- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).
- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).
- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).
- iio: buffer: serialize buffer teardown with mode claims (git-fixes).
- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).
- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).
- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).
- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).
- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).
- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).
- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).
- iio: proximity: aw96103: validate firmware data length (git-fixes).
- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).
- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).
- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).
- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).
- Input: aiptek - validate raw macro indices before updating state (stable-fixes).
- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).
- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).
- Input: eeti_ts - publish the OF module alias (git-fixes).
- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).
- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).
- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).
- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).
- Input: soc_button_array - check btns_desc->package.count (git-fixes).
- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).
- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).
- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).
- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).
- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).
- Input: xpad - add support for Azeron devices (stable-fixes).
- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).
- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).
- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).
- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.
- kernel-binary.spec.in: Fix syntax error.
- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).
- keys: fix lost wakeup when reaping a dead key type (git-fixes).
- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).
- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).
- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).
- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).
- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).
- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).
- KVM: nVMX: Always flush vpid02 on first use (git-fixes).
- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).
- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).
- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).
- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).
- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).
- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).
- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).
- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).
- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).
- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).
- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).
- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).
- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).
- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).
- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).
- media: i2c: imx355: Replace client->dev usage (stable-fixes).
- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).
- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).
- media: qcom: camss: avoid format string warning (stable-fixes).
- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).
- media: video-i2c: fix buffer queue ordering (stable-fixes).
- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).
- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).
- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).
- mfd: rsmu: Add 8a34002 support (stable-fixes).
- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).
- mmc: core: Add validation for host-provided max_segs (stable-fixes).
- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).
- mmc: core: Fix OF node reference leak on card add failure (git-fixes).
- mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes).
- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).
- mmc: hsq: Fix use-after-free in retry work (git-fixes).
- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).
- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).
- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).
- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).
- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).
- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).
- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).
- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).
- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).
- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).
- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).
- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).
- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).
- mtd: core: call _get_device() with the master MTD (git-fixes).
- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).
- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).
- mtd: rawnand: pl353: Fix debug prints (git-fixes).
- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).
- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).
- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).
- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).
- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).
- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).
- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).
- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).
- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).
- net: usb: sr9700: include receive overhead in the length check (git-fixes).
- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).
- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).
- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).
- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).
- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).
- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).
- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).
- nfc: nfcmrvl: validate helper command length before pull (git-fixes).
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).
- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).
- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).
- nfc: st21nfca: validate received frame size (git-fixes).
- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).
- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).
- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).
- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).
- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).
- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).
- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).
- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).
- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).
- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).
- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).
- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).
- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).
- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).
- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).
- PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes).
- PCI: xgene: Drop unnecessary OF node reference (git-fixes).
- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).
- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).
- pinctrl: meson: Fix typo in s4 group name (git-fixes).
- pinctrl: single: free the IRQ on domain creation failure (git-fixes).
- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).
- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).
- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).
- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).
- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).
- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).
- platform/x86: ISST: Validate max level for set feature (git-fixes).
- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).
- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).
- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).
- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).
- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).
- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).
- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).
- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).
- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).
- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).
- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).
- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).
- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).
- powerpc: Add Power12 architected mode (jsc#PED-16906).
- powerpc: Add Power12 raw mode (jsc#PED-16906).
- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).
- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).
- RDMA/core: Fix potential use after free in counter_release() (git-fixes).
- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).
- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).
- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).
- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).
- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).
- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).
- RDMA/hfi1: Create workqueues before device initialization (git-fixes).
- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).
- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).
- RDMA/hfi1: Free RX data on late probe failure (git-fixes).
- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).
- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).
- RDMA/hfi1: Preserve unit 0 on (git-fixes).
- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).
- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).
- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).
- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).
- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).
- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).
- RDMA/rvt: Return NULL after port allocation failure (git-fixes).
- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).
- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).
- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).
- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).
- rtc: ac100: Assign .num before accessing .hws (git-fixes).
- rtc: aspeed: add AST2700 compatible (stable-fixes).
- rtc: bq32000: add delay between RTC reads (stable-fixes).
- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).
- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).
- rtc: mv: add suspend/resume support for wakeup (stable-fixes).
- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).
- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).
- serial: 8250: fix possible ISR soft lockup (stable-fixes).
- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).
- serial: fix TIOCMIWAIT race (git-fixes).
- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).
- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).
- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).
- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).
- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).
- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).
- soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes).
- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).
- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).
- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).
- soundwire: only handle alert events when the peripheral is attached (stable-fixes).
- soundwire: validate DT compatible before parsing it (stable-fixes).
- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).
- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).
- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).
- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).
- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).
- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).
- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).
- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).
- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).
- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).
- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).
- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).
- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).
- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).
- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).
- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).
- thunderbolt: Reject oversized XDomain properties responses (git-fixes).
- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).
- thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes).
- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).
- tpm: Disable TPM on null key name mismatch (git-fixes).
- tty: serial: max3100: shut down timer before freeing port (git-fixes).
- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).
- tty: vt: fix memory leak in vc_allocate() (git-fixes).
- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).
- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).
- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).
- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).
- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).
- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).
- usb: cdns3: rename hibernated argument of role->resume() to lost_power (stable-fixes).
- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).
- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).
- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).
- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).
- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).
- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).
- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).
- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).
- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).
- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).
- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes).
- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).
- usb: gadget: udc: skip pullup() if already connected (stable-fixes).
- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).
- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).
- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).
- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).
- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).
- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).
- usb: ohci-st: disable controller wakeup on removal (git-fixes).
- USB: serial: fix driver deregistration order (git-fixes).
- USB: serial: fix dynamic id driver deregistration race (git-fixes).
- USB: serial: fix ioctl hangup race (git-fixes).
- USB: serial: fix port tear down use-after-free (git-fixes).
- USB: serial: quatech2: fix baud rate overflow (git-fixes).
- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).
- USB: serial: ssu100: fix baud rate overflow (git-fixes).
- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).
- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).
- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).
- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).
- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).
- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).
- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).
- usb: usbtmc: don't store usb_device_id (stable-fixes).
- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).
- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).
- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).
- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).
- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).
- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).
- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
- watchdog: digicolor: Avoid division by zero (git-fixes).
- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).
- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).
- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).
- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).
- watchdog: msc313e: Propagate error code in resume() (git-fixes).
- watchdog: rtd119x: Avoid division by zero (git-fixes).
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).
- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).
- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).
- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).
- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).
- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).
- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).
- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).
- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).
- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).
- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).
- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).
- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).
- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).
- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).
- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).
- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).
- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).
- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).
- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).
- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).
- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).
- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).
- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).
- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).
- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).
- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).
- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).
- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).
- wifi: libertas: reject short monitor TX frames (stable-fixes).
- wifi: libipw: fix key index receive bound checks (stable-fixes).
- wifi: libipw: reject too-short association responses (git-fixes).
- wifi: libipw: reject too-short beacon and probe responses (git-fixes).
- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).
- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).
- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).
- wifi: mac80211: don't access the TSF of a down interface (git-fixes).
- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).
- wifi: mac80211: don't allow link changes when iface is down (git-fixes).
- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).
- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).
- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).
- wifi: mac80211: don't start a ROC while scanning (git-fixes).
- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).
- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).
- wifi: mac80211: mesh: release the channel if start fails (git-fixes).
- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).
- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).
- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).
- wifi: mac80211: reset state when starting AP fails (git-fixes).
- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).
- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).
- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).
- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).
- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).
- wifi: mt76: add init_wiphy callback (stable-fixes).
- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).
- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).
- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).
- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).
- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).
- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).
- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).
- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).
- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).
- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).
- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).
- wifi: mwifiex: validate action frame fixed fields (git-fixes).
- wifi: mwifiex: validate scan response extents (git-fixes).
- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).
- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).
- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).
- wifi: rsi: fix heap OOB write on key removal (git-fixes).
- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).
- wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes).
- wifi: rtw88: Fix the random 'error beacon valid' messages for USB (stable-fixes).
- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).
- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).
- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).
- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).
- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).
- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).
- wifi: virt_wifi: don't transfer operstate before register (git-fixes).
- wifi: virt_wifi: free skb when disconnected (git-fixes).
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).
- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).
- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).
-----------------------------------------------------------------
Advisory ID: 1909
Released: Tue Oct 13 17:13:54 2026
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References:
This update for rpm fixes the following issues:
Changes in rpm:
- Do not dependent on python3-base, it is perfectly OK to use
any Python interpreter for python-rpm-packaging.
- Remove obsolete Python2-based removal of Python directories.
-----------------------------------------------------------------
Advisory ID: 1916
Released: Wed Oct 14 17:16:30 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
The following package changes have been done:
- libpng16-16-1.6.59-160000.1.1 updated
- rpm-4.20.1-160000.4.1 updated
- grub2-common-2.12-160000.8.1 updated
- libopenssl3-3.5.0-160000.11.1 updated
- grub2-x86_64-efi-2.12-160000.8.1 updated
- grub2-i386-pc-2.12-160000.8.1 updated
- grub2-2.12-160000.8.1 updated
- kernel-rt-6.12.0-160000.39.1 updated
- container:elemental-base-os-common-16.0-4.13-16.0-4.13-4.13 added
- container:elemental-base-os-common-16.0-4.1-16.0-4.1-4.1 removed
More information about the sle-container-updates
mailing list