SUSE-SU-2026:4660-1

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
• CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
• CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519).
• CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
• CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
• CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).
• CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).
• CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
• CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
• CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
• CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
• CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
• CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
• CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
• CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).
• CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
• CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
• CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
• CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
• CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
• CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).
• CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
• CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
• CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
• CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
• CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).
• CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
• CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
• CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
• CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
• CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
• CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
• CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
• CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (bsc#1276572).
• CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
• CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
• CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
• CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
• CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
• CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
• CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).
• CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
• CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
• CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
• CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
• CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
• CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
• CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).
• CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
• CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
• CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
• CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
• CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
• CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
• CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
• CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
• CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
• CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
• CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
• CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
• CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
• CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
• CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
• CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
• CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
• CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).
• CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).
• CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
• CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
• CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
• CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
• CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
• CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
• CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
• CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
• CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
• CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
• CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

The following non security issues were fixed:

• Also reflect disabled BATMAN in supported.conf.
• Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
• Disable CONFIG_CAN (jsc#PED-16993).
• Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927).
• RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
• arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
• arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
• arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
• arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
• arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
• arm64: percpu: Fix this_cpu_write() casting (git-fixes).
• compiler_types: Introduce __flex_counter() and family (bsc#1280139).
• default_gfp(): avoid using the 'newfangled' VA_OPT trick (bsc#1280139).
• docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401).
• firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
• i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
• kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401).
• kernel-binary.spec.in: Fix syntax error.
• net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
• net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
• net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
• net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).
• perf: Reject exited events as group leaders (git-fixes).
• selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).
• selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).
• selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).
• slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).
• slab: Introduce kmalloc_flex() and family (bsc#1280139).
• slab: Introduce kmalloc_obj() and family (bsc#1280139).
• slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
• smb: client: harden DFS cache against invalid target hints (git-fixes).
• tls: add counters for rekey (bsc#1267564 jsc#PED-16401).
• tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).
• tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).
• tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).
• x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).