Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484). - CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494). - CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591). - CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365). - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369). - CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722). - CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567). - CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618). - CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635). - CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684). - CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966). - CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022). - CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993). - CVE-2026-46330: Revert 'net/smc: Introduce TCP ULP support' (bsc#1268049). - CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660). - CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100). - CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033). - CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036). - CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989). - CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022). - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159). - CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172). - CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174). - CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184). - CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195). - CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193). - CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090). - CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398). - CVE-2026-53052: ASoC: qcom: qdsp6: topology: check widget type before accessing data (bsc#1269314). - CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310). - CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678). - CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681). - CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821). - CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795). - CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269884). - CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986). - CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574). - CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993). - CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257). - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059). - CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269493). - CVE-2026-53366: ipv4: account for fraggap on the paged allocation path (bsc#1271366). The following non security issues were fixed: - hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes). - ipv4: account for fraggap on the paged allocation path (git-fixes). - ipv6: account for fraggap on the paged allocation path (git-fixes). - KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050). - KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050). - KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050). - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303). - loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303). - module: fix init_module_from_file() error handling (jsc#PED-16303). - module: make waiting for a concurrent module loader interruptible (jsc#PED-16303). - module: Split modules_install compression and in-kernel decompression (jsc#PED-16303). - module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303). - module: warn about excessively long module waits (jsc#PED-16303). - modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303). - net: mana: Add support for PF device 0x00C1 (bsc#1268237). - net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes). - net: mana: Create separate EQs for each vPort (git-fixes). - net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes). - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes). - net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes). - net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes). - net: mana: Optimize irq affinity for low vcpu configs (git-fixes). - net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes). - net: mana: Use GIC functions to allocate global EQs (git-fixes). - RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes). - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes). - scsi: storvsc: Replace symbolic permissions with octal (git-fixes). - scsi: target: Fix hexadecimal CHAP_I handling (git-fixes). - x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305). - x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305).