SUSE-SU-2026:24371-1

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode (bsc#1277260).
• CVE-2026-80893: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (bsc#1279706).
• CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
• CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
• CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).
• CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).
• CVE-2026-89706: NFSD: Limit the number of concurrent async COPY operations (bsc#1280477).
• CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966).
• CVE-2026-89811: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (bsc#1281144).
• CVE-2026-89987: mm/huge_memory: transfer the pmd dirty bit to the folio on zap (bsc#1281819).
• CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
• CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525).
• CVE-2026-90283: hugetlbfs: release subpool on fill_super failure (bsc#1281771).
• CVE-2026-90289: drm/amd/display: Resize MST HDCP per-connector arrays to 32 (bsc#1281726).
• CVE-2026-90315: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (bsc#1281865).
• CVE-2026-92488: RDMA/erdma: complete object teardown when the destroy command fails (bsc#1281979).
• CVE-2026-93222: signal: avoid shared siginfo namespace rewrites (bsc#1282742).
• CVE-2026-93252: ocfs2: fix circular locking dependency in ocfs2_init_acl() (bsc#1282784).
• CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).
• CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
• CVE-2026-93806: wifi: cfg80211: validate assoc response length before status and IE access (bsc#1283037).
• CVE-2026-97415: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (bsc#1282768).
• CVE-2026-97416: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (bsc#1282770).
• CVE-2026-97491: net/rds: Don't sleep inside rds_ib_conn_path_shutdown (bsc#1283142).
• CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
• CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
• CVE-2026-97595: mac802154: fix use-after-free of sdata via queued RX frames (bsc#1283736).
• CVE-2026-97945: replace with mainline version and update References (bsc#1283144).
• CVE-2026-98010: net/sched: drr: clamp quantum in change class (bsc#1283823).
• CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
• CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
• CVE-2026-98077: netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (bsc#1283979).
• CVE-2026-98089: bonding: alb: fix uninitialized transport header access in alb_determine_nd() (bsc#1283936).
• CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
• CVE-2026-98173: smb: client: fix use-after-free of iface in cifs_try_adding_channels() (bsc#1284415).
• CVE-2026-98216: IB/hfi1: Fix the PIO_CRED credit-return mmap (bsc#1284559).
• CVE-2026-98252: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (bsc#1284581).
• CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
• CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
• CVE-2026-98269: btrfs: abort transaction on failure to update inode for hole punching and reflinking (bsc#1284606).
• CVE-2026-98273: x86/kprobes: Fix crash when probing CS CALL instructions (bsc#1284462).
• CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
• CVE-2026-98347: IB/IPoIB: Avoid restoring OPER_UP after multicast flush (bsc#1284295).
• CVE-2026-98352: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (bsc#1284647).
• CVE-2026-98354: RDMA/mad: Fix receive buffer leak when PKey enforcement fails (bsc#1284291).
• CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
• CVE-2026-98358: IB/iser: reject a remote invalidation of an unregistered direction (bsc#1284289).
• CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
• CVE-2026-98360: RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (bsc#1284649).
• CVE-2026-98365: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (bsc#1284288).
• CVE-2026-98366: RDMA/rxe: validate access flags before swapping the MR's PD (bsc#1284655).
• CVE-2026-98367: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (bsc#1284424).
• CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).

The following non security issues were fixed:

• ASoC: adau1372: allow sleepy powerdown GPIOs (git-fixes).
• ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes (git-fixes).
• ASoC: cs42l52: Fix the NG Type Switch bit (git-fixes).
• ASoC: cs42l56: Put the Limiter Cushion control on the limiter register (git-fixes).
• ASoC: Intel: avs: Reset the stream unless it is already prepared (git-fixes).
• ASoC: max98371: Fix the Speaker DHT Min Volume bits (git-fixes).
• ASoC: nau8822: Fix the 128x oversampling switch bits (git-fixes).
• ASoC: pcm3168a: Fix the DAC zero flag polarity bit (git-fixes).
• ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM (git-fixes).
• ASoC: stm32: spdifrx: fix synchronization state check (git-fixes).
• ASoC: wm8978: Fix the 128x oversampling switch bits (git-fixes).
• Bluetooth: hci_sock: Serialize dead-device detachment (git-fixes).
• Bluetooth: MGMT: Fix status of pending commands flushed on power off (git-fixes).
• Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown (git-fixes).
• Bluetooth: RFCOMM: free the skb when the DLC has no owner (git-fixes).
• Drivers: hv: Avoid infinite retry loop in init_vp_index() (git-fixes).
• Drivers: hv: Don't reset VMBus connection state on error/exit paths (git-fixes).
• Drivers: hv: vmbus: fix typo "substract" in comment (git-fixes).
• drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set (git-fixes).
• drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks (git-fixes).
• drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (git-fixes).
• drm/amdkfd: align SDMA doorbell base for shader doorbell writes (git-fixes).
• drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info (git-fixes).
• drm/aspeed: Balance the display clock enable on teardown (git-fixes).
• drm/dp: don't mark the AUX backlight enabled when enabling failed (git-fixes).
• drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN (git-fixes).
• drm/gud: don't keep a connector without a CRTC as connector_state (git-fixes).
• drm/i915/gem: Prevent overstepping exec array boundary (git-fixes).
• drm/i915/gt: Unmask interrupts only when ACTIVE is true (git-fixes).
• drm/vc4: drain the hangcheck timer and works on V3D unbind (git-fixes).
• drm/vc4: Free the BO cache size list on teardown (git-fixes).
• gpio: exar: initialize the ID before registering its cleanup (git-fixes).
• gpio: xilinx: fix runtime PM leak on request error path (git-fixes).
• IB/hfi1: Resolve the credit-return buffer through the send context's node (git-fixes).
• kernel-binary.spec.in: Fix syntax error.
• KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits (bsc#1215199).
• KVM: PPC: Book3S HV: Add missing mappings for tracing exits (bsc#1215199).
• KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users (bsc#1215199).
• KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls (bsc#1215199).
• KVM: PPC: Book3S HV: Free the queue pages in error path (bsc#1215199).
• KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form (bsc#1215199).
• KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).
• KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).
• memstick: core: wait for request completion before freeing card (git-fixes).
• memstick: rtsx_usb_ms: complete requests after eject instead of dropping them (git-fixes).
• mmc: cavium-octeon: destroy slot platform devices on remove (git-fixes).
• mmc: cavium-thunderx: destroy slot platform devices on remove (git-fixes).
• mmc: mtk-sd: Cancel request timeout work on remove (git-fixes).
• mmc: sdhci-sprd: disable runtime PM on remove (git-fixes).
• net: mana: reserve RX buffer headroom to fix forwarding performance (git-fixes).
• net: mctp-i2c: fix duplicate reception of old data (bsc#1266730).
• net: usb: ax88179_178a: fix rx frame length for non-last packets (git-fixes).
• netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684).
• PCI: hv: Probe vPCI buses asynchronously (git-fixes).
• PCI: hv: Warn when wait_for_response() waits indefinitely (git-fixes).
• pinctrl: amd: Clear S4 wake bits when firmware has _AEI (git-fixes).
• power: supply: ds2780: Fix ds2780_get_capacity() returning raw value (git-fixes).
• power: supply: Fix maintenance charge table kernel-doc (git-fixes).
• power: supply: generic-adc-battery: Fix temperature IIO channel conversion (git-fixes).
• powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard (bsc#1215199).
• pseries/plpks: clear SED key data after use (bsc#1215199).
• pseries/plpks: clear sensitive PLPKS buffers (bsc#1215199).
• pseries/plpks: clear signed update authentication buffer (bsc#1215199).
• pseries/plpks: fix error handling in plpks_read_var() (bsc#1215199).
• pseries/plpks: make narrowing conversions explicit (bsc#1215199).
• pseries/plpks: validate input to plpks_signed_update_var() (bsc#1215199).
• regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (git-fixes).
• serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).
• tools/hv: fix typo "retrive" in comment (git-fixes).
• tools: gpio: fix building from the top level with O= (git-fixes).
• wifi: brcmfmac: fix P2P device removal race in brcmf_detach() (git-fixes).
• wifi: mt76: mt792x: pick the SAR table layout from the table itself (git-fixes).
• wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit (git-fixes).
• xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).