SUSE-SU-2026:4687-1

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).
• CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).
• CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).
• CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).
• CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).
• CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).
• CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).
• CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).
• CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).
• CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).
• CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).
• CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).
• CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
• CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
• CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64496: iio: event: Fix event FIFO reset race (bsc#1273600).
• CVE-2026-64540: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (bsc#1273302).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68108: drm/amdgpu/vce: fix integer overflow in image size (bsc#1274869).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68184: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (bsc#1274981).
• CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
• CVE-2026-68350: wifi: carl9170: fix OOB read from off-by-two in TX status handler (bsc#1274682).
• CVE-2026-68365: USB: serial: io_edgeport: cap received transmit credits (bsc#1276257).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).
• CVE-2026-68479: Bluetooth: btrtl: validate firmware patch bounds (bsc#1276585).
• CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).
• CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).
• CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).
• CVE-2026-72166: net/9p: avoid -ERESTARTSYS leak to userspace (bsc#1277556).
• CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).
• CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).
• CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).
• CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).
• CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).
• CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
• CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).
• CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).
• CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).
• CVE-2026-72436: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (bsc#1277245).
• CVE-2026-72444: flow_dissector: fix false-positive __read_overflow2_field() warning (bsc#1278100).
• CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).
• CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).
• CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519).
• CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).
• CVE-2026-74276: spi: xilinx: use FIFO occupancy register to determine buffer size (bsc#1276495).
• CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).
• CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
• CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).
• CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).
• CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).
• CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).
• CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).
• CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).
• CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
• CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).
• CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067).
• CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).
• CVE-2026-74386: nvmet-tcp: fix a memory leak when releasing a queue (bsc#1277098).
• CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
• CVE-2026-74424: fbcon: fix NULL pointer dereference for a console without vc_data (bsc#1276321).
• CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
• CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
• CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
• CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
• CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).
• CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
• CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).
• CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).
• CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
• CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).
• CVE-2026-74497: ALSA: usb-audio: Clamp frame size in implicit-feedback mode (bsc#1275957).
• CVE-2026-74498: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (bsc#1275958).
• CVE-2026-74499: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (bsc#1275959).
• CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).
• CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
• CVE-2026-74585: thunderbolt: Bound the DROM dual link port number before indexing sw->ports (bsc#1277881).
• CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
• CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
• CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
• CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).
• CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
• CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).
• CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).
• CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
• CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
• CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310).
• CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).
• CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).
• CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).
• CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).
• CVE-2026-74682: ALSA: usb-audio: fix OOB write on Type II inbound URBs (bsc#1276934).
• CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
• CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).
• CVE-2026-74691: net: thunderbolt: Tear down DMA paths before stopping the rings (bsc#1276925).
• CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
• CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).
• CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).
• CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).
• CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
• CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
• CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
• CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).
• CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).
• CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).
• CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).
• CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).
• CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).
• CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).
• CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
• CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
• CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).
• CVE-2026-80798: nfc: llcp: reject PDUs shorter than the LLCP header (bsc#1279809).
• CVE-2026-80800: nfc: llcp: bound the connect_sn TLV walk to the skb (bsc#1279812).
• CVE-2026-80829: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (bsc#1279485).
• CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
• CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
• CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).
• CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
• CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).
• CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).
• CVE-2026-80908: drm/amdgpu: Reject UVD message with dimensions above 4096 (bsc#1279627).
• CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
• CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).
• CVE-2026-81005: ipmi: si: Fix NULL pointer dereference after failed registration (bsc#1280230).
• CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).
• CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).
• CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
• CVE-2026-89480: nvme-tcp: Do not reset transport on data digest errors (bsc#1280449).
• CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).
• CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).
• CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).
• CVE-2026-89524: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (bsc#1280581).
• CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).
• CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).
• CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).
• CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
• CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
• CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
• CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).
• CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).
• CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).
• CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
• CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).
• CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).
• CVE-2026-89752: mm: memcg: stop reclaim when a limit update is superseded (bsc#1281176).
• CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).
• CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).
• CVE-2026-89870: media: zoran: Avoid freeing a registered video_device twice (bsc#1281352).
• CVE-2026-89927: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (bsc#1281429).
• CVE-2026-89929: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (bsc#1281358).
• CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).
• CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
• CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).
• CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).
• CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).
• CVE-2026-90223: nfc: llcp: bound SNL TLV parsing to the skb and add length checks (bsc#1281708).
• CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
• CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).
• CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).
• CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).
• CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
• CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
• CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).
• CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).
• CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270).
• CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
• CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).
• CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).
• CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
• CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).
• CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).
• CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).
• CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).
• CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).
• CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).
• CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

The following non security issues were fixed:

• Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (git-fixes).
• default_gfp(): avoid using the 'newfangled' VA_OPT trick (bsc#1280139).
• Fix backport of 'RDMA/efa: Fix PBL chunk length computation' Refresh:.
• gpio: mvebu: Use IS_REACHABLE instead of IS_ENABLED for CONFIG_PWM (git-fixes).
• i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
• kernel-binary.spec.in: Fix syntax error.
• KVM: nVMX: Always flush vpid02 on first use (git-fixes).
• RDMA/efa: Fix PBL chunk length computation.
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).
• scripts/osc_wrapper: Select repository appropriate for architecture.
• scripts: Add kernel_repos.
• scripts: obsapi: Kick get_kernel_projects from uploader
• scripts: obsapi: Kick get_project_repo_archs from uploader
• slab: Introduce kmalloc_obj() and family (bsc#1280139).
• slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
• smb3: missing inode locks in punch hole (git-fixes).
• smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
• xfs: don't drain buffer lru on freeze and read-only remount (bsc#1280223).