SUSE-SU-2026:22903-1

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
• CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
• CVE-2026-43019: Bluetooth: hciconn: fix potential UAF in setcigparamssync (bsc#1264003).
• CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
• CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
• CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
• CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TXEN-to-PLLON for TMDS on DCN35 (bsc#1264548).
• CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
• CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
• CVE-2026-43226: net/rds: No shortcut out of RDSCONNERROR (bsc#1264544).
• CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
• CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
• CVE-2026-43253: iommu/amd: move waitonsem() out of spinlock (bsc#1260593).
• CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
• CVE-2026-43304: libceph: define and enforce CEPHMAXKEY_LEN (bsc#1264993).
• CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvmedbbufset (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable() (bsc#1264794).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
• CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4EXTDATA_VALID1 (bsc#1266773).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
• CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
• CVE-2026-45997: scsi: sd: fix missing putdisk() when deviceadd(&disk_dev) fails (bsc#1266740).
• CVE-2026-46046: ext4: fix missing brelse() in ext4xattrinodedecref_all() (bsc#1266726).
• CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
• CVE-2026-46051: md/raid5: fix soft lockup in retryalignedread() (bsc#1267360).
• CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
• CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
• CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
• CVE-2026-46161: md/raid10: fix divide-by-zero in setupgeo() with zero farcopies (bsc#1266838).
• CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4ibcreate_srq() (bsc#1267493).
• CVE-2026-46242: eventpoll: Fix integer overflow in eploopcheck_proc() (bsc#1267618).
• CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop (bsc#1267992).
• CVE-2026-46322: tun: free page on buildskb failure in tunxdp_one() (bsc#1267994).
• CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
• CVE-2026-52933: iouring/poll: fix signed comparison in iopollgetownership() (bsc#1268989).
• CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __cephxdecrypt() (bsc#1269172).
• CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
• CVE-2026-52961: ceph: fix BUG_ON in _cephbuildxattrsblob() due to stale blob size (bsc#1269129).
• CVE-2026-52993: tipc: fix double-free in tipcbufappend() (bsc#1269193).
• CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).
• CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).
• CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).
• CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).
• CVE-2026-53049: gfs2: add some missing log locking (bsc#1269646).
• CVE-2026-53050: quota: Fix race of dquotscanactive() with quota deactivation (bsc#1269188).
• CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).
• CVE-2026-53075: ppp: require CAPNETADMIN in target netns for unattached ioctls (bsc#1269690).
• CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (bsc#1269700).
• CVE-2026-53086: net: bcmgenet: fix racing timeout handler (bsc#1269537).
• CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
• CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups (bsc#1269262).
• CVE-2026-53167: fuse: limit FUSENOTIFYRETRIEVE to uptodate folios (bsc#1269768).
• CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories (bsc#1269645).
• CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISERHEADERSLEN (bsc#1269710).
• CVE-2026-53178: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction (bsc#1269795).
• CVE-2026-53181: vsock/vmci: fix skackbacklog leak on failed handshake (bsc#1269886).
• CVE-2026-53196: USB: serial: ioti: fix heap overflow in getmanuf_info() (bsc#1269986).
• CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use (bsc#1269680).
• CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer (bsc#1269587).
• CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset (bsc#1269989).
• CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdpframe leak on XDPTX xmit failure (bsc#1269691).
• CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrppduparse_vecattr (bsc#1269675).
• CVE-2026-53249: ipv4: restrict IPOPTSSRR and IPOPTLSRR options (bsc#1269992).
• CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcommconnectind() (bsc#1269993).
• CVE-2026-53258: wifi: fix leak if split 6 GHz scanning fails (bsc#1269230).
• CVE-2026-53274: net/smc: fix sleep-inside-lock in _smcsetsockopt() causing local DoS (bsc#1269651).
• CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DCRUNWITHPREEMPTIONENABLED (bsc#1269527).
• CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).
• CVE-2026-53357: Bluetooth: fix UAF in l2capsockcleanuplisten() vs l2capconn_del() (bsc#1270257).
• CVE-2026-53366: kernel: ipv4: account for fraggap on the paged allocation path (bsc#1271366)

The following non security issues were fixed:

• batman-adv: access unicast_ttvn skb->data only after skb realloc (git-fixes).
• batman-adv: bla: reacquire gw address after skb realloc (git-fixes).
• batman-adv: dat: acquire ARP hw source only after skb realloc (git-fixes).
• batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).
• batman-adv: gw: acquire ethernet header only after skb realloc (git-fixes).
• Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes).
• Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes).
• Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes).
• Bluetooth: fix UAF in btacceptdequeue() (git-fixes).
• Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled (git-fixes).
• Bluetooth: ISO: exclude RFU bits from ISOSDULength (git-fixes).
• Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes).
• Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes).
• Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes).
• Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete (git-fixes).
• bnxten: Add a timeout parameter to bnxthwrmportts_query() (bsc#1264180).
• bnxten: Add istspkt field to struct bnxtswtxbd (bsc#1264180).
• bnxt_en: Add new TX timestamp completion definitions (bsc#1264180).
• bnxt_en: Add TX timestamp completion logic (bsc#1264180).
• bnxt_en: Allow some TX packets to be unprocessed in NAPI (bsc#1264180).
• bnxt_en: fix module unload sequence (bsc#1264180).
• bnxt_en: Fix PTP firmware timeout parameter (bsc#1264180).
• bnxt_en: improve TX timestamping FIFO configuration (bsc#1264180).
• bnxt_en: Increase the max total outstanding PTP TX packets to 4 (bsc#1264180).
• bnxten: Let bnxtstamptxskb() return error code (bsc#1264180).
• bnxt_en: Refactor all PTP TX timestamp fields into a struct (bsc#1264180).
• bnxt_en: Remove an impossible condition check for PTP TX pending SKB (bsc#1264180).
• bnxten: Remove atomic operations on ptp->txavail (bsc#1264180).
• bnxt_en: Retry PTP TX timestamp from FW for 1 second (bsc#1264180).
• bnxt_en: silence clang build warning (bsc#1264180).
• crypto: qat - Replace kzalloc() + copyfromuser() with memdup_user() (stable-fixes).
• crypto: qat - Return pointer directly in adfctlalloc_resources (stable-fixes).
• drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prev_sink reference (git-fixes).
• drm/amd/display: Handle struct drmplanestate.ignoredamageclips (git-fixes).
• drm/amdgpu: fix aperture mapping leak (git-fixes).
• drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe() (git-fixes).
• drm/i915: Return NULL on error in active_instance (git-fixes).
• drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).
• drm/i915/gem: Fix NULL deref in I915CONTEXTPARAM_SSEU (git-fixes).
• drm/virtio: bound EDID block reads to the response buffer (git-fixes).
• fbdev: Fix fbnewmodelist to prevent null-ptr-deref in fbvideomodeto_var (stable-fixes).
• fbdev: fix use-after-free in store_modes() (stable-fixes).
• gpio-f7188x: Add support for NCT6126D version B (git-fixes).
• gpio: htc-egpio: use managed gpiochip registration (git-fixes).
• gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).
• gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).
• gpios: palmas: add .get_direction() op (git-fixes).
• HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes).
• HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes).
• HID: picolcd: prevent NULL pointer dereference in picolcdsendand_wait() (git-fixes).
• hwmon: (asus_atk0110) Check package count before accessing element (git-fixes).
• hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes).
• hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes).
• hwmon: adm1275: Prevent reading uninitialized stack (git-fixes).
• iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).
• iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).
• iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).
• iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).
• iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).
• iio: event: Fix event FIFO reset race (git-fixes).
• iio: imu: bmi160: add IRQFNOTHREAD to data-ready trigger IRQ (git-fixes).
• iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).
• iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).
• iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).
• iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).
• Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).
• Input: mms114 - fix multi-touch slot corruption (git-fixes).
• iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes).
• ipv4: account for fraggap on the paged allocation path (git-fixes).
• KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).
• KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).
• KVM: x86/mmu: Rename kvmtdpmmuzapsp() to better indicate its purpose (bsc#1271050).
• KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).
• net: mana: Validate the packet length reported by the NIC (git-fixes).
• net: phy: sfp: free miibus in sfpi2cmdiobusdestroy (git-fixes).
• net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes).
• net: usb: net1080: validate packetlen before pad-byte access in rxfixup (git-fixes).
• net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes).
• pinctrl: meson: restore non-sleeping GPIO access (git-fixes).
• ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302).
• regulator: core: regulatorlocktwo() should test for EDEADLK not EDEADLOCK (git-fixes).
• serial: 8250omap: clear rxrunning on zero-length DMA completes (git-fixes).
• serial: msm: Disable DMA for kernel console UART (git-fixes).
• staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).
• staging: rtl8723bs: fix OOB read in updatebeaconinfo() IE loop (git-fixes).
• staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq() and joincmd_hdl() (git-fixes).
• staging: rtl8723bs: fix OOB reads in isapin_tkip() IE loop (git-fixes).
• staging: rtl8723bs: fix OOB write in HTcapshandler() (git-fixes).
• staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).
• tpm: Make the TPM character devices non-seekable (git-fixes).
• usb: cdnsp: fix stream context array leak in cdnspallocstream_info() (git-fixes).
• USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).
• usb: dwc3: meson-g12a: fix refcount leak in dwc3mesong12a_resume() (git-fixes).
• usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).
• usb: free iso schedules on failed submit (git-fixes).
• usb: gadget: composite: fix dead empty check in the USBDTOTG handler (git-fixes).
• usb: gadget: f_printer: take kref only for successful open (git-fixes).
• USB: idmouse: fix use-after-free on disconnect race (git-fixes).
• USB: iowarrior: fix use-after-free on disconnect (git-fixes).
• USB: ldusb: fix use-after-free on disconnect race (git-fixes).
• USB: legousbtower: fix use-after-free on disconnect race (git-fixes).
• USB: misc: uss720: unregister parport on probe failure (git-fixes).
• usb: mtu3: unmap request DMA on queue failure (git-fixes).
• USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).
• USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).
• USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).
• USB: serial: keyspan_pda: fix information leak (git-fixes).
• usb: sl811-hcd: disable controller wakeup on remove (git-fixes).
• USB: storage: include USFLNO_SAME in quirks mask (git-fixes).
• usb: typec: anx7411: use devmpmruntime_enable() (git-fixes).
• usb: typec: class: drop PD lookup reference (git-fixes).
• usb: typec: tcpm: Validate SVID index in svdmconsumemodes() (git-fixes).
• usb: typec: ucsi: cancel pending work on system suspend (git-fixes).
• usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).
• usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).
• usb: typec: ucsi: Pass full DP config payload in SETNEWCAM for DP alt mode (git-fixes).
• USB: ulpi: fix memory leak on registration failure (git-fixes).
• USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).
• usb: xhci: Fix sleep in atomic context in xhcifreestreams() (git-fixes).
• usbip: tools: support SuperSpeedPlus devices (git-fixes).
• usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).
• usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup() (git-fixes).
• wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes).
• wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes).