FlawAtlas
Search the atlas
SUSE-SU-2026:3166-1 Not scored

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603). - CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837). - CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765). - CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077). - CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003). - CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056). - CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270). - CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545). - CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624). - CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580). - CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548). - CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304). - CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556). - CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531). - CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328). - CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544). - CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386). - CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321). - CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302). - CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419). - CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429). - CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853). - CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993). - CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987). - CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112). - CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089). - CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079). - CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744). - CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041). - CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023). - CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794). - CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142). - CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997). - CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790). - CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978). - CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731). - CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000). - CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399). - CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458). - CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773). - CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883). - CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893). - CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). - CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204). - CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213). - CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432). - CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740). - CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449). - CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744). - CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472). - CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726). - CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686). - CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360). - CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494). - CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495). - CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497). - CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592). - CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524). - CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445). - CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722). - CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502). - CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616). - CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838). - CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493). - CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690). - CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691). - CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234). - CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618). - CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683). - CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992). - CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024). - CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994). - CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001). - CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036). - CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989). - CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133). - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159). - CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172). - CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174). - CVE-2026-52961: ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (bsc#1269129). - CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254). - CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193). - CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124). - CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111). - CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106). - CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098). - CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095). - CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151). - CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190). - CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389). - CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392). - CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164). - CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690). - CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700). - CVE-2026-53086: net: bcmgenet: fix racing timeout handler (bsc#1269537). - CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532). - CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262). - CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768). - CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645). - CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710). - CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795). - CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886). - CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663). - CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986). - CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680). - CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587). - CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989). - CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711). - CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877). - CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691). - CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677). - CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992). - CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993). - CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230). - CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257). - CVE-2026-53272: erofs: fix use-after-free on sbi->sync_decompress (bsc#1269809). - CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651). - CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527). - CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814). - CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249). - CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257). - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (bsc#1270302). - CVE-2026-53366: ipv4: account for fraggap on the paged allocation path (bsc#1271366). The following non security issues were fixed: - ALSA: hda: conexant: Remove mic bias threshold override (git-fixes). - ALSA: hda: Fix cached processing coefficient verbs (git-fixes). - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes). - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes). - ASoC: cs42l43: Correct report for forced microphone jack (git-fixes). - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes). - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes). - batman-adv: access unicast_ttvn skb->data only after skb realloc (git-fixes). - batman-adv: bla: reacquire gw address after skb realloc (git-fixes). - batman-adv: dat: acquire ARP hw source only after skb realloc (git-fixes). - batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes). - batman-adv: gw: acquire ethernet header only after skb realloc (git-fixes). - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes). - Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes). - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes). - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes). - Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes). - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes). - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes). - Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes). - Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes). - Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes). - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes). - bnxt_en: Add a timeout parameter to bnxt_hwrm_port_ts_query() (bsc#1264180). - bnxt_en: Add is_ts_pkt field to struct bnxt_sw_tx_bd (bsc#1264180). - bnxt_en: Add new TX timestamp completion definitions (bsc#1264180). - bnxt_en: Add TX timestamp completion logic (bsc#1264180). - bnxt_en: Allow some TX packets to be unprocessed in NAPI (bsc#1264180). - bnxt_en: fix module unload sequence (bsc#1264180). - bnxt_en: Fix PTP firmware timeout parameter (bsc#1264180). - bnxt_en: improve TX timestamping FIFO configuration (bsc#1264180). - bnxt_en: Increase the max total outstanding PTP TX packets to 4 (bsc#1264180). - bnxt_en: Let bnxt_stamp_tx_skb() return error code (bsc#1264180). - bnxt_en: Refactor all PTP TX timestamp fields into a struct (bsc#1264180). - bnxt_en: Remove an impossible condition check for PTP TX pending SKB (bsc#1264180). - bnxt_en: Remove atomic operations on ptp->tx_avail (bsc#1264180). - bnxt_en: Retry PTP TX timestamp from FW for 1 second (bsc#1264180). - bnxt_en: silence clang build warning (bsc#1264180). - bpf: Disambiguate SCALAR register state output in verifier logs (bsc#1271249). - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (stable-fixes). - crypto: qat - Return pointer directly in adf_ctl_alloc_resources (stable-fixes). - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes). - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes). - drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes). - drm/amd/pm: fix smu13 power limit range calculation (git-fixes). - drm/amdgpu: fix aperture mapping leak (git-fixes). - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes). - drm/gfx10: Program DB_RING_CONTROL (git-fixes). - drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes). - drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes). - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes). - drm/i915: Return NULL on error in active_instance (git-fixes). - drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes). - drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes). - drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes). - drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes). - drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes). - drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes). - drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes). - drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes). - drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes). - drm/virtio: bound EDID block reads to the response buffer (git-fixes). - drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes). - drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes). - drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes). - drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes). - drm/xe: remove duplicate <kunit/test-bug.h> include (git-fixes). - fbdev: efifb: fix memory leak in efifb_probe() (git-fixes). - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes). - fbdev: fix use-after-free in store_modes() (stable-fixes). - fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes). - git_sort: Add workqueue maintainer tree. - git_sort: Update nf-next branch. - gpio-f7188x: Add support for NCT6126D version B (git-fixes). - gpio: htc-egpio: use managed gpiochip registration (git-fixes). - gpio: mvebu: fail probe if gpiochip registration fails (git-fixes). - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - gpios: palmas: add .get_direction() op (git-fixes). - HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes). - HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes). - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes). - hwmon: (asus_atk0110) Check package count before accessing element (git-fixes). - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes). - hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes). - hwmon: adm1275: Prevent reading uninitialized stack (git-fixes). - i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes). - i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes). - iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes). - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes). - iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes). - iio: adc: spear: Initialize completion before requesting IRQ (git-fixes). - iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes). - iio: event: Fix event FIFO reset race (git-fixes). - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes). - iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes). - iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes). - iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes). - iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes). - Input: maplemouse - fix NULL pointer dereference in open() (git-fixes). - Input: mms114 - fix multi-touch slot corruption (git-fixes). - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250). - io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250). - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250 bsc#1271287). - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes). - ipvs: Move defense_work to system_dfl_long_wq (bsc#1257605). - ixgbe: reduce number of reads when getting OROM data (bsc#1269637). - KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050). - KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050). - KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050). - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042 bsc#1270396). - mm: Do not allocate shrinker info with cgroup.memory=nokmem (bsc#1256564). - net/handshake: do not send request when the socket is closed (bsc#1251942). - net: mana: Sync page pool RX frags for CPU (git-fixes). - net: mana: Validate the packet length reported by the NIC (git-fixes). - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes). - net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes). - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes). - net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes). - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562). - pinctrl: meson: restore non-sleeping GPIO access (git-fixes). - ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302). - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes). - s390/ap: Externalize AP bus specific bitmap reading function (jsc#PED-15897). - s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270268). - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270263). - s390/vfio-ap: Add sysfs attr, ap_config, to export mdev state (jsc#PED-15897). - s390/vfio-ap: Add write support to sysfs attr ap_config (jsc#PED-15897). - s390/vfio-ap: Driver feature advertisement (jsc#PED-15897). - s390/vfio-ap: Ignore duplicate link requests in vfio_ap_mdev_link_queue (jsc#PED-15897). - scripts/submit_branch: do submission right after upload. - sctp: validate embedded address parameter length (git-fixes). - selftests/alsa: Fix memory leak in find_controls error path (git-fixes). - selftests/bpf: Add uprobe_multi to gen_tar target (bsc#1271248). - selftests/bpf: Make align selftests more robust (bsc#1271249). - serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes). - serial: msm: Disable DMA for kernel console UART (git-fixes). - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes). - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes). - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes). - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes). - staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes). - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes). - tools: hv: Fix cross-compilation (git-fixes). - tpm: Make the TPM character devices non-seekable (git-fixes). - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes). - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes). - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes). - usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes). - usb: free iso schedules on failed submit (git-fixes). - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes). - usb: gadget: f_printer: take kref only for successful open (git-fixes). - USB: idmouse: fix use-after-free on disconnect race (git-fixes). - USB: iowarrior: fix use-after-free on disconnect (git-fixes). - USB: ldusb: fix use-after-free on disconnect race (git-fixes). - USB: legousbtower: fix use-after-free on disconnect race (git-fixes). - USB: misc: uss720: unregister parport on probe failure (git-fixes). - usb: mtu3: unmap request DMA on queue failure (git-fixes). - USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes). - USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes). - USB: serial: digi_acceleport: fix write buffer corruption (git-fixes). - USB: serial: keyspan_pda: fix information leak (git-fixes). - usb: sl811-hcd: disable controller wakeup on remove (git-fixes). - USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes). - usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes). - usb: typec: class: drop PD lookup reference (git-fixes). - usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes). - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes). - usb: typec: ucsi: cancel pending work on system suspend (git-fixes). - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes). - usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes). - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes). - USB: ulpi: fix memory leak on registration failure (git-fixes). - USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes). - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes). - usbip: tools: support SuperSpeedPlus devices (git-fixes). - usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes). - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes). - wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes). - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes). - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).

Exploit probability Not scored
Published July 21, 2026
Required by Not available
Last source change July 22, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-64kb
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-default
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-default-base
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-source
SUSE:Linux Enterprise Module for Basesystem 15 SP7 kernel-zfcpdump
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-docs
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-obs-build
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-source
SUSE:Linux Enterprise Module for Development Tools 15 SP7 kernel-syms
SUSE:Linux Enterprise Module for Legacy 15 SP7 kernel-default
SUSE:Linux Enterprise Live Patching 15 SP7 kernel-default
SUSE:Linux Enterprise Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_19
SUSE:Linux Enterprise Module for Public Cloud 15 SP7 kernel-azure
SUSE:Linux Enterprise High Availability Extension 15 SP7 kernel-default
SUSE:Linux Enterprise Workstation Extension 15 SP7 kernel-default

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2026:3166-1

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603). - CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837). - CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765). - CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077). - CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003). - CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056). - CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270). - CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545). - CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624). - CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580). - CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548). - CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304). - CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556). - CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531). - CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328). - CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544). - CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386). - CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321). - CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302). - CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419). - CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429). - CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853). - CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993). - CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987). - CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112). - CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089). - CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079). - CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744). - CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041). - CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023). - CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794). - CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142). - CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997). - CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790). - CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978). - CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731). - CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000). - CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399). - CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458). - CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773). - CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883). - CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893). - CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). - CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204). - CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213). - CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432). - CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740). - CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449). - CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744). - CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472). - CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726). - CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686). - CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360). - CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494). - CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495). - CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497). - CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592). - CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524). - CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445). - CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722). - CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502). - CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616). - CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838). - CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493). - CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690). - CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691). - CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234). - CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618). - CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683). - CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992). - CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024). - CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994). - CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001). - CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036). - CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989). - CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133). - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159). - CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172). - CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174). - CVE-2026-52961: ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (bsc#1269129). - CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254). - CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193). - CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124). - CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111). - CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106). - CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098). - CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095). - CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151). - CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190). - CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389). - CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392). - CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164). - CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690). - CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700). - CVE-2026-53086: net: bcmgenet: fix racing timeout handler (bsc#1269537). - CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532). - CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262). - CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768). - CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645). - CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710). - CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795). - CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886). - CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663). - CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986). - CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680). - CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587). - CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989). - CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711). - CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877). - CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691). - CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677). - CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992). - CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993). - CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230). - CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257). - CVE-2026-53272: erofs: fix use-after-free on sbi->sync_decompress (bsc#1269809). - CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (bsc#1269651). - CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (bsc#1269527). - CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814). - CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249). - CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257). - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (bsc#1270302). - CVE-2026-53366: ipv4: account for fraggap on the paged allocation path (bsc#1271366). The following non security issues were fixed: - ALSA: hda: conexant: Remove mic bias threshold override (git-fixes). - ALSA: hda: Fix cached processing coefficient verbs (git-fixes). - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes). - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes). - ASoC: cs42l43: Correct report for forced microphone jack (git-fixes). - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes). - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes). - batman-adv: access unicast_ttvn skb->data only after skb realloc (git-fixes). - batman-adv: bla: reacquire gw address after skb realloc (git-fixes). - batman-adv: dat: acquire ARP hw source only after skb realloc (git-fixes). - batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes). - batman-adv: gw: acquire ethernet header only after skb realloc (git-fixes). - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes). - Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes). - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes). - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (git-fixes). - Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes). - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes). - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes). - Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes). - Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes). - Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes). - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes). - bnxt_en: Add a timeout parameter to bnxt_hwrm_port_ts_query() (bsc#1264180). - bnxt_en: Add is_ts_pkt field to struct bnxt_sw_tx_bd (bsc#1264180). - bnxt_en: Add new TX timestamp completion definitions (bsc#1264180). - bnxt_en: Add TX timestamp completion logic (bsc#1264180). - bnxt_en: Allow some TX packets to be unprocessed in NAPI (bsc#1264180). - bnxt_en: fix module unload sequence (bsc#1264180). - bnxt_en: Fix PTP firmware timeout parameter (bsc#1264180). - bnxt_en: improve TX timestamping FIFO configuration (bsc#1264180). - bnxt_en: Increase the max total outstanding PTP TX packets to 4 (bsc#1264180). - bnxt_en: Let bnxt_stamp_tx_skb() return error code (bsc#1264180). - bnxt_en: Refactor all PTP TX timestamp fields into a struct (bsc#1264180). - bnxt_en: Remove an impossible condition check for PTP TX pending SKB (bsc#1264180). - bnxt_en: Remove atomic operations on ptp->tx_avail (bsc#1264180). - bnxt_en: Retry PTP TX timestamp from FW for 1 second (bsc#1264180). - bnxt_en: silence clang build warning (bsc#1264180). - bpf: Disambiguate SCALAR register state output in verifier logs (bsc#1271249). - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (stable-fixes). - crypto: qat - Return pointer directly in adf_ctl_alloc_resources (stable-fixes). - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes). - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes). - drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes). - drm/amd/pm: fix smu13 power limit range calculation (git-fixes). - drm/amdgpu: fix aperture mapping leak (git-fixes). - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes). - drm/gfx10: Program DB_RING_CONTROL (git-fixes). - drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes). - drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes). - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes). - drm/i915: Return NULL on error in active_instance (git-fixes). - drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes). - drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes). - drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes). - drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes). - drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes). - drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes). - drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes). - drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes). - drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes). - drm/virtio: bound EDID block reads to the response buffer (git-fixes). - drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes). - drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes). - drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes). - drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes). - drm/xe: remove duplicate <kunit/test-bug.h> include (git-fixes). - fbdev: efifb: fix memory leak in efifb_probe() (git-fixes). - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes). - fbdev: fix use-after-free in store_modes() (stable-fixes). - fbdev: modedb: fix a possible UAF in fb_find_mode() (stable-fixes). - git_sort: Add workqueue maintainer tree. - git_sort: Update nf-next branch. - gpio-f7188x: Add support for NCT6126D version B (git-fixes). - gpio: htc-egpio: use managed gpiochip registration (git-fixes). - gpio: mvebu: fail probe if gpiochip registration fails (git-fixes). - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - gpios: palmas: add .get_direction() op (git-fixes). - HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes). - HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes). - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes). - hwmon: (asus_atk0110) Check package count before accessing element (git-fixes). - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes). - hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes). - hwmon: adm1275: Prevent reading uninitialized stack (git-fixes). - i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes). - i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes). - iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes). - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes). - iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes). - iio: adc: spear: Initialize completion before requesting IRQ (git-fixes). - iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes). - iio: event: Fix event FIFO reset race (git-fixes). - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes). - iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes). - iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes). - iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes). - iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes). - Input: maplemouse - fix NULL pointer dereference in open() (git-fixes). - Input: mms114 - fix multi-touch slot corruption (git-fixes). - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250). - io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250). - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (git-fixes bsc#1261250 bsc#1271287). - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes). - ipvs: Move defense_work to system_dfl_long_wq (bsc#1257605). - ixgbe: reduce number of reads when getting OROM data (bsc#1269637). - KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050). - KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050). - KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050). - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - mm/vmstat: defer the refresh_zone_stat_thresholds after all CPUs bringup (bsc#1270042 bsc#1270396). - mm: Do not allocate shrinker info with cgroup.memory=nokmem (bsc#1256564). - net/handshake: do not send request when the socket is closed (bsc#1251942). - net: mana: Sync page pool RX frags for CPU (git-fixes). - net: mana: Validate the packet length reported by the NIC (git-fixes). - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes). - net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes). - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes). - net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes). - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (bsc#1261562). - pinctrl: meson: restore non-sleeping GPIO access (git-fixes). - ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302). - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes). - s390/ap: Externalize AP bus specific bitmap reading function (jsc#PED-15897). - s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270268). - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270263). - s390/vfio-ap: Add sysfs attr, ap_config, to export mdev state (jsc#PED-15897). - s390/vfio-ap: Add write support to sysfs attr ap_config (jsc#PED-15897). - s390/vfio-ap: Driver feature advertisement (jsc#PED-15897). - s390/vfio-ap: Ignore duplicate link requests in vfio_ap_mdev_link_queue (jsc#PED-15897). - scripts/submit_branch: do submission right after upload. - sctp: validate embedded address parameter length (git-fixes). - selftests/alsa: Fix memory leak in find_controls error path (git-fixes). - selftests/bpf: Add uprobe_multi to gen_tar target (bsc#1271248). - selftests/bpf: Make align selftests more robust (bsc#1271249). - serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes). - serial: msm: Disable DMA for kernel console UART (git-fixes). - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes). - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes). - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes). - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes). - staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes). - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes). - tools: hv: Fix cross-compilation (git-fixes). - tpm: Make the TPM character devices non-seekable (git-fixes). - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes). - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes). - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes). - usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes). - usb: free iso schedules on failed submit (git-fixes). - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes). - usb: gadget: f_printer: take kref only for successful open (git-fixes). - USB: idmouse: fix use-after-free on disconnect race (git-fixes). - USB: iowarrior: fix use-after-free on disconnect (git-fixes). - USB: ldusb: fix use-after-free on disconnect race (git-fixes). - USB: legousbtower: fix use-after-free on disconnect race (git-fixes). - USB: misc: uss720: unregister parport on probe failure (git-fixes). - usb: mtu3: unmap request DMA on queue failure (git-fixes). - USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes). - USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes). - USB: serial: digi_acceleport: fix write buffer corruption (git-fixes). - USB: serial: keyspan_pda: fix information leak (git-fixes). - usb: sl811-hcd: disable controller wakeup on remove (git-fixes). - USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes). - usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes). - usb: typec: class: drop PD lookup reference (git-fixes). - usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes). - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes). - usb: typec: ucsi: cancel pending work on system suspend (git-fixes). - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes). - usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes). - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes). - USB: ulpi: fix memory leak on registration failure (git-fixes). - USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes). - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes). - usbip: tools: support SuperSpeedPlus devices (git-fixes). - usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes). - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes). - wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes). - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes). - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain (stable-fixes).

View original source

05 / REFERENCES

Further evidence