Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603). - CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013). - CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485). - CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484). - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018). - CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526). - CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522). - CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779). - CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584). - CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781). - CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707). - CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710). - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638). - CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796). - CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797). - CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602). - CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665). - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085). - CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093). - CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095). - CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734). - CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001). - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758). - CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065). - CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176). - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165). - CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723). - CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600). - CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (bsc#1263797). - CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582). - CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170). - CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131). - CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141). - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668). - CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901). - CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882). - CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059). - CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181). - CVE-2026-46331: kernel: net/sched: fix pedit partial COW leading to page cache - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931). - CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933). - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097). - CVE-2026-43044: crypto: caam - fix DMA corruption on long hmac keys (bsc#1264087). - CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082). - CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482). - CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr. - CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634). - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848). - CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651). - CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085). - CVE-2026-43330: crypto: caam - fix overflow on long hmac keys (bsc#1264801). - CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response (bsc#1265090). - CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119). - CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116). - CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126). - CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626). The following non security issues were fixed: - btrfs: reject root items with drop_progress and zero drop_level (git-fixes). - btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes). - check-for-config-changes: Exclude CC_MS_EXTENSIONS. - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}. - dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes). - hv_sock: fix ARM64 support (git-fixes). - ice: set max queues in alloc_etherdev_mqs() (git-fixes). - kdump, documentation: describe craskernel CMA reservation (jsc#PED-7249). - mkspec: Add signature to source list only when it exists. - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626). - net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421). - net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes). - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes). - net: mana: Don't overwrite port probe error with add_adev result (git-fixes). - net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846). - net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes). - net: mana: Fix RX skb truesize accounting (bsc#1248754). - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes). - net: mana: Guard mana_remove against double invocation (git-fixes). - net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes). - net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes). - net: mana: Init gf_stats_work before potential error paths in probe (git-fixes). - net: mana: Init link_change_work before potential error paths in probe (git-fixes). - net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes). - net: mana: Set default number of queues to 16 (bsc#1261648). - net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes). - net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes). - net: mana: Use pci_name() for debugfs directory naming (git-fixes). - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718). - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718). - PCI: hv: Set default NUMA node to 0 for devices without affinity info (git-fixes). - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Validate rx_hash_key_len (git-fixes). - RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes). - RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes). - RDMA/mana_ib: Support memory windows (git-fixes). - sched/balancing: Switch the 'DEFINE_SPINLOCK(balancing)' spinlock into an 'atomic_t sched_balance_running' flag (bsc#1253754). - sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961). - sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1253754). - sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961). - sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961). - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1253754). - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes). - scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449). - tty: tty_io: update timestamps on all device nodes (bsc#1262020). - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - workqueue: Break up enum definitions and give names to the types (bsc#1260522). - workqueue: Clean up enum work_bits and related constants (bsc#1260522). - workqueue: Factor out work_grab_pending() from __cancel_work_sync() (bsc#1260522). - workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (bsc#1260522). - workqueue: Implement disable/enable for (delayed) work items (bsc#1260522). - workqueue: Introduce work_cancel_flags (bsc#1260522). - workqueue: Make @flags handling consistent across set_work_data() and friends (bsc#1260522). - workqueue: Preserve OFFQ bits in cancel[_sync] paths (bsc#1260522). - workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() (bsc#1260522). - workqueue: Reorganize flush and cancel[_sync] functions (bsc#1260522). - Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).