Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700). - CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663). - CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769). - CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774). - CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790). - CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093). - CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995). - CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551). - CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989). - CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001). - CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009). - CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960). - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711). - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889). - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205). - CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222). - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220). - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901). - CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969). - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972). - CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238). The following non security issues were fixed: - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes). - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes). - drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes). - drm/hyperv: validate VMBus packet size in receive callback (git-fixes). - net: gro: don't merge zcopy skbs (git-fixes). - net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes). - net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414). - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928). - net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes). - net: mana: Skip redundant detach on already-detached port (git-fixes). - net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765). - net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765). - net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402). - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes). - s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068). - s390/entry: Scrub r12 register on kernel entry (bsc#1263068). - s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068). - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).