Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884). - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502). - CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548). - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619). - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791). - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603). - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619). - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622). - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624). - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615). - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606). - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006). - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062). - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058). - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180). - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794). - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579). - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724). - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115). - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594). - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883). - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040). - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932). - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000). - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091). - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196). - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243). - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245). - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255). - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484). - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415). - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622). - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609). - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114). - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723). - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081). - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672). - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765). - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400). - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394). - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711). - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720). - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810). - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888). - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889). - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827). - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914). - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205). - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214). - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220). - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901). - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696). - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531). - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927). - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972). - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652). - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816). - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826). The following non security issues were fixed: - accel/ivpu: Add bounds checks for firmware log indices (git-fixes). - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes). - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes). - ALSA: seq: dummy: fix UMP event stack overread (git-fixes). - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes). - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes). - Bluetooth: bnep: reject short frames before parsing (git-fixes). - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes). - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes). - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes). - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes). - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes). - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes). - config: remove DEBUG_FS_DISALLOW_MOUNT - debugfs: Remove broken no-mount mode (bsc#1265186). - debugfs: Fix default access mode config check (bsc#1265186). - debugfs: Remove broken no-mount mode (bsc#1265186). - debugfs: Remove redundant access mode checks (bsc#1265186). - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes). - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes). - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes). - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes). - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes). - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes). - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes). - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes). - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes). - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes). - ima: return error early if file xattr cannot be changed (bsc#1261041). - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes). - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes). - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes). - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes). - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes). - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes). - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes). - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes). - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes). - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes). - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes). - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes). - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes). - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes). - KVM: SVM: Convert plain error code numbers to defines (git-fixes). - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes). - KVM: SVM: Provide helpers to set the error code (git-fixes). - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes). - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes). - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes). - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes). - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes). - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes). - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes). - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes). - mmc: core: Fix host controller programming for fixed driver type (git-fixes). - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes). - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes). - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes). - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes). - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes). - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).