SUSE-SU-2026:5121-1

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703 bsc#1275737).
• CVE-2026-23059: scsi: qla2xxx: Sanitize payload size to prevent member overflow (bsc#1257737 bsc#1275737).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64379: smb: client: mask server-provided mode to 07777 in modefromsid (bsc#1273029).
• CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64539: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (bsc#1273338).
• CVE-2026-64546: drm/edid: fix OOB read in drm_parse_tiled_block() (bsc#1273334).
• CVE-2026-64549: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (bsc#1273341).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72310: smb: client: fix overflow in passthrough ioctl bounds check (bsc#1277750).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74683: Input: evdev - sanitize event type index when fetching event masks (bsc#1277387).
• CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode (bsc#1277260).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80704: drm/amd/display: use proper context for logging (bsc#1278431).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80764: Bluetooth: hci_event: fix LE list UAF on reset (bsc#1279493).
• CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
• CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
• CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write (bsc#1279494).
• CVE-2026-80881: ocfs2: fix buffer head management in ocfs2_read_blocks() (bsc#1279496).
• CVE-2026-80888: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (bsc#1279455).
• CVE-2026-80978: net: cap advertised IP tunnel headroom (bsc#1280253).
• CVE-2026-80989: net: thunderbolt: Mark the connection down when bringing it up fails (bsc#1280305).
• CVE-2026-89494: ocfs2: validate lengths in dlm_mig_lockres_handler (bsc#1280520).
• CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler (bsc#1280569).
• CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (bsc#1280713).
• CVE-2026-89559: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (bsc#1280554).
• CVE-2026-89606: ecryptfs: reject too-small tag 70 packets (bsc#1280469).
• CVE-2026-89607: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (bsc#1281792).
• CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826).
• CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
• CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
• CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).
• CVE-2026-89640: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (bsc#1280950).
• CVE-2026-89642: cifs: call pagecache_isize_extended() in cifs_setsize() when extending (bsc#1280970).
• CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563).
• CVE-2026-89821: drm/amd/display: avoid divide-by-zero in __is_lut_linear() (bsc#1280996).
• CVE-2026-89842: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started (bsc#1275737 bsc#1281189).
• CVE-2026-89843: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (bsc#1275737 bsc#1280984).
• CVE-2026-89844: scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition (bsc#1275737 bsc#1281183).
• CVE-2026-89845: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (bsc#1275737 bsc#1281001).
• CVE-2026-89846: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (bsc#1275737 bsc#1281184).
• CVE-2026-89847: scsi: qla2xxx: Avoid double completion in async IOCB timeout (bsc#1275737 bsc#1281185).
• CVE-2026-89848: scsi: qla2xxx: Quiesce response IRQ before freeing request queue (bsc#1275737 bsc#1281179).
• CVE-2026-89849: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (bsc#1275737 bsc#1281180).
• CVE-2026-89850: scsi: qla2xxx: Don't query firmware state while chip is down (bsc#1275737 bsc#1281181).
• CVE-2026-89851: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (bsc#1275737 bsc#1281175).
• CVE-2026-89852: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (bsc#1275737 bsc#1281174).
• CVE-2026-89853: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (bsc#1275737 bsc#1281173).
• CVE-2026-89854: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (bsc#1275737 bsc#1281165).
• CVE-2026-89855: scsi: qla2xxx: Serialize flash version read in reset handler (bsc#1275737 bsc#1281164).
• CVE-2026-89857: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject (bsc#1275737 bsc#1281211).
• CVE-2026-89858: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (bsc#1275737 bsc#1281334).
• CVE-2026-89859: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (bsc#1275737 bsc#1281333).
• CVE-2026-89860: scsi: qla2xxx: Initialize NVMe abort_work once at submission (bsc#1275737 bsc#1281357).
• CVE-2026-89861: scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (bsc#1275737 bsc#1281353).
• CVE-2026-89862: scsi: qla2xxx: Fix BSG job leak on validate flash image error path (bsc#1275737 bsc#1281214).
• CVE-2026-89863: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (bsc#1275737 bsc#1281251).
• CVE-2026-89864: scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (bsc#1275737 bsc#1281253).
• CVE-2026-89865: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (bsc#1275737 bsc#1281254).
• CVE-2026-90015: xhci: fix lost bounce buffers on TDs spanning several ring segments (bsc#1281080).
• CVE-2026-90057: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() (bsc#1281650).
• CVE-2026-90081: net/rds: use wq_has_sleeper() in rds_cong_map_updated() (bsc#1281490).
• CVE-2026-90103: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (bsc#1281538).
• CVE-2026-90125: smb: client: fix request buffer leak in smb2_new_read_req() (bsc#1281580).
• CVE-2026-90138: vsock: don't check the listener's sk_err in vsock_accept() (bsc#1281535).
• CVE-2026-90227: nvme: fine-granular CAP_SYS_ADMIN for nvme io commands (bsc#1281705).
• CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).
• CVE-2026-93210: smb: client: harden DFS cache against invalid target hints (bsc#1282737).
• CVE-2026-93231: lockd: fix swapped arguments in nlmsvc_match_ip() (bsc#1282778).
• CVE-2026-93242: scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (bsc#1275737 bsc#1282684).
• CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush() (bsc#1283004).
• CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).
• CVE-2026-93785: cifs: validate idmap key payload length (bsc#1282869).
• CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).
• CVE-2026-93817: perf: Fix addr_filter_ranges lifetime (bsc#1283017).
• CVE-2026-97527: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (bsc#1275737 bsc#1283343).
• CVE-2026-97528: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (bsc#1275737 bsc#1283360).
• CVE-2026-97530: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (bsc#1275737 bsc#1283159).
• CVE-2026-97531: scsi: qla2xxx: Skip vport under deletion in report ID acquisition (bsc#1275737 bsc#1283834).
• CVE-2026-97535: scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (bsc#1275737 bsc#1283837).
• CVE-2026-97537: scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (bsc#1275737 bsc#1283453).
• CVE-2026-97612: net: mpls: clear inner_protocol when the last label is popped (bsc#1283967).
• CVE-2026-97926: ufs: validate cylinder group metadata before caching it (bsc#1283887).
• CVE-2026-97954: net/rds: fix tcp stream corruption with large pages (bsc#1283113).
• CVE-2026-97965: vxlan: initialize _md in vxlan_xmit_one() (bsc#1282963).
• CVE-2026-98014: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (bsc#1283668).
• CVE-2026-98022: net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (bsc#1283810).
• CVE-2026-98071: net/rds: clear cp_flags bits individually in rds_conn_path_reset() (bsc#1283842).
• CVE-2026-98072: net/rds: use wq_has_sleeper() in release_in_xmit() (bsc#1283846).
• CVE-2026-98074: bonding: do not clear curr_active_slave prematurely when releasing all slaves (bsc#1283871).
• CVE-2026-98078: ipvs: fix reversed sequence option serialization (bsc#1284150).
• CVE-2026-98095: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header() (bsc#1283921).
• CVE-2026-98116: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (bsc#1283878).
• CVE-2026-98158: ppp_async: drop the errored frame instead of resetting its headroom (bsc#1283933).
• CVE-2026-98257: rds: ib: use rds_conn_drop() on protocol version mismatch (bsc#1284346).
• CVE-2026-98282: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (bsc#1284360).
• CVE-2026-98386: scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot (bsc#1275737 bsc#1285668).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).

The following non security issues were fixed:

• net/rds: use clear_bit_unlock() in release_refill() (git-fixes).
• nvmet-tcp: do not continue for invalid icreq (git-fixes).
• ocfs2: reserve xattr value tree metadata only once (git-fixes).
• rds: add missing barrier to release_refill (git-fixes).
• Revert 'mkspec: Exclude rt flavor from kernel-syms dependencies' (bsc#1244337). - Revert 'rpm/mkspec: Fix missing kernel-syms-rt creation' (bsc#1244337).