SUSE-SU-2026:22112-1

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifssetcifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxlpayloadfromuserallowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with globaltxfc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hidhwrequest (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in updatesuperwork when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bonddebugrlbhashshow (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipidsihost_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nrpages calculation overflow in filemapmap_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrmuser: fix info leak in buildreport() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inodeswitchwbsworkfn() (bsc#1263883).
• CVE-2026-31774: iouring/net: fix slab-out-of-bounds read in iobundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTAEXPECTNAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndiscrauseropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfsattrirecover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4mbrelease() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4fcreplay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4mbfindbygoal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfsmapblock() after btrfschunkmapnumcopies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsdnllistenersetdoit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipcskfilter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudpfillmetadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxesrqfrom_init (bsc#1266711).
• CVE-2026-45856: RDMA/uverbs: Validate wqesize before using it in ibuverbspostsend (bsc#1266720).
• CVE-2026-45886: bpf: Fix bpfxdpstore_bytes proto for read-only arg (bsc#1266810).
• CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
• CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
• CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
• CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
• CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/down (bsc#1267205).
• CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
• CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payloadsize() in rxercv (bsc#1266901).
• CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
• CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
• CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
• CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
• CVE-2026-46159: btrfs: fix btrfsioctlspaceinfo() slotcount TOCTOU which can lead to info-leak (bsc#1267652).
• CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5ibdevressrq_init() (bsc#1266816).
• CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4srqevent() (bsc#1266826).

The following non security issues were fixed:

• accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
• accel/ivpu: Add buffer overflow check in MS getinfoioctl (git-fixes).
• ALSA: PCM: Fix wait queue list corruption in sndpcmdrain() on linked streams (git-fixes).
• ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
• arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
• arm64: tlb: Optimize ARM64WORKAROUNDREPEAT_TLBI (git-fixes).
• Bluetooth: bnep: reject short frames before parsing (git-fixes).
• Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
• Bluetooth: ISO: Fix not releasing hdev reference on isoconnbig_sync (git-fixes).
• Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
• Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
• Bluetooth: RFCOMM: hold listener socket in rfcommconnectind() (git-fixes).
• Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
• config: remove DEBUGFSDISALLOW_MOUNT
• debugfs: Remove broken no-mount mode (bsc#1265186).
• debugfs: Fix default access mode config check (bsc#1265186).
• debugfs: Remove broken no-mount mode (bsc#1265186).
• debugfs: Remove redundant access mode checks (bsc#1265186).
• drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
• drm/amd/display: Clamp HDMI HDCP2 rxidlist read to buffer size (git-fixes).
• drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
• drm/amd/display: Reject gpiobitshift >= 32 in biosparsergetgpiopininfo() (git-fixes).
• drm/amd/display: Use kreallocarray() in dalvector_reserve() (git-fixes).
• drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
• drm/amdkfd: fix NULL dereference in getqueueids() (git-fixes).
• drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
• drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
• drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
• ima: return error early if file xattr cannot be changed (bsc#1261041).
• Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
• KVM: arm64: Reassign nestedmmus array behind mmulock (git-fixes).
• KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
• KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
• KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
• KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
• KVM: SEV: Don't explicitly pass PSC buffer to snpbeginpsc() (git-fixes).
• KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
• KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
• KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
• KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
• KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
• KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
• KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
• KVM: SVM: Convert plain error code numbers to defines (git-fixes).
• KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
• KVM: SVM: Provide helpers to set the error code (git-fixes).
• KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
• KVM: x86: Dedup kvmsevesmmio{read,write}() (git-fixes).
• KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
• KVM: x86: Move MMIO write tracing into vcpummiowrite() (git-fixes).
• KVM: x86: Open code handling of completed MMIO reads in emulatorreadwrite() (git-fixes).
• KVM: x86: Open code read vs. write userspace MMIO exits in emulatorreadwrite() (git-fixes).
• KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
• KVM: x86: Use local MMIO fragment variable to clean up emulatorreadwrite() (git-fixes).
• mmc: core: Fix host controller programming for fixed driver type (git-fixes).
• mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
• mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
• mmc: litexmmc: Use DIVROUND_UP for more accurate clock calculation (git-fixes).
• mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
• mmc: sdhci: add signal voltage switch in sdhciresumehost (git-fixes).
• wifi: mac80211: limit injected antenna index in ieee80211parsetx_radiotap (git-fixes).
• wifi: nl80211: reject oversized EMA RNR lists (git-fixes).