The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633). - CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133). - CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138). - CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412). - CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410). - CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464). - CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848). - CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985). - CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990). - CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234). - CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081). - CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131). - CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816). - CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834). - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953). - CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642). - CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499). - CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517). - CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522). - CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523). - CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890). - CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023). - CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473). - CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472). - CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480). - CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471). - CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879). - CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769). - CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480). - CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211). - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953). - CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976). - CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420). - CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011). - CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026). - CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889). - CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776). - CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868). - CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603). - CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061). - CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). - CVE-2026-64496: iio: event: Fix event FIFO reset race (bsc#1273600). - CVE-2026-64540: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (bsc#1273302). - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037). - CVE-2026-68108: drm/amdgpu/vce: fix integer overflow in image size (bsc#1274869). - CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920). - CVE-2026-68184: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (bsc#1274981). - CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629). - CVE-2026-68350: wifi: carl9170: fix OOB read from off-by-two in TX status handler (bsc#1274682). - CVE-2026-68365: USB: serial: io_edgeport: cap received transmit credits (bsc#1276257). - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836). - CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831). - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277). - CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495). - CVE-2026-68479: Bluetooth: btrtl: validate firmware patch bounds (bsc#1276585). - CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865). - CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923). - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801). - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803). - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814). - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818). - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249). - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149). - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543). - CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321). - CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349). - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545). - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544). - CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231). - CVE-2026-72166: net/9p: avoid -ERESTARTSYS leak to userspace (bsc#1277556). - CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215). - CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656). - CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674). - CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143). - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972). - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007). - CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784). - CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822). - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009). - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857). - CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128). - CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381). - CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035). - CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122). - CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056). - CVE-2026-72436: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (bsc#1277245). - CVE-2026-72444: flow_dissector: fix false-positive __read_overflow2_field() warning (bsc#1278100). - CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109). - CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064). - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519). - CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508). - CVE-2026-74276: spi: xilinx: use FIFO occupancy register to determine buffer size (bsc#1276495). - CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473). - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475). - CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468). - CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460). - CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461). - CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462). - CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905). - CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866). - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129). - CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180). - CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067). - CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405). - CVE-2026-74386: nvmet-tcp: fix a memory leak when releasing a queue (bsc#1277098). - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410). - CVE-2026-74424: fbcon: fix NULL pointer dereference for a console without vc_data (bsc#1276321). - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210). - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211). - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178). - CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792). - CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781). - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340). - CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335). - CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339). - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353). - CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892). - CVE-2026-74497: ALSA: usb-audio: Clamp frame size in implicit-feedback mode (bsc#1275957). - CVE-2026-74498: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (bsc#1275958). - CVE-2026-74499: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (bsc#1275959). - CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954). - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681). - CVE-2026-74585: thunderbolt: Bound the DROM dual link port number before indexing sw->ports (bsc#1277881). - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820). - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766). - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904). - CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900). - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493). - CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918). - CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896). - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906). - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191). - CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310). - CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272). - CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311). - CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396). - CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392). - CVE-2026-74682: ALSA: usb-audio: fix OOB write on Type II inbound URBs (bsc#1276934). - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489). - CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314). - CVE-2026-74691: net: thunderbolt: Tear down DMA paths before stopping the rings (bsc#1276925). - CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927). - CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921). - CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565). - CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247). - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094). - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315). - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590). - CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268). - CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485). - CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265). - CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555). - CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416). - CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716). - CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536). - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619). - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621). - CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799). - CVE-2026-80798: nfc: llcp: reject PDUs shorter than the LLCP header (bsc#1279809). - CVE-2026-80800: nfc: llcp: bound the connect_sn TLV walk to the skb (bsc#1279812). - CVE-2026-80829: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (bsc#1279485). - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835). - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786). - CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850). - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532). - CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535). - CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525). - CVE-2026-80908: drm/amdgpu: Reject UVD message with dimensions above 4096 (bsc#1279627). - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263). - CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375). - CVE-2026-81005: ipmi: si: Fix NULL pointer dereference after failed registration (bsc#1280230). - CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379). - CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338). - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786). - CVE-2026-89480: nvme-tcp: Do not reset transport on data digest errors (bsc#1280449). - CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451). - CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551). - CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508). - CVE-2026-89524: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (bsc#1280581). - CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738). - CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716). - CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717). - CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719). - CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758). - CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546). - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727). - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733). - CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577). - CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054). - CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509). - CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243). - CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184). - CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468). - CVE-2026-89752: mm: memcg: stop reclaim when a limit update is superseded (bsc#1281176). - CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224). - CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226). - CVE-2026-89870: media: zoran: Avoid freeing a registered video_device twice (bsc#1281352). - CVE-2026-89927: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (bsc#1281429). - CVE-2026-89929: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (bsc#1281358). - CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359). - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229). - CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397). - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546). - CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955). - CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599). - CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808). - CVE-2026-90223: nfc: llcp: bound SNL TLV parsing to the skb and add length checks (bsc#1281708). - CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680). - CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778). - CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732). - CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050). - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113). - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110). - CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143). - CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973). - CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270). - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284). - CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408). - CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812). - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906). - CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154). - CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803). - CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201). - CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163). - CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973). - CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935). - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881). The following non security issues were fixed: - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (git-fixes). - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139). - Fix backport of 'RDMA/efa: Fix PBL chunk length computation' Refresh:. - gpio: mvebu: Use IS_REACHABLE instead of IS_ENABLED for CONFIG_PWM (git-fixes). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - kernel-binary.spec.in: Fix syntax error. - KVM: nVMX: Always flush vpid02 on first use (git-fixes). - RDMA/efa: Fix PBL chunk length computation. - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896). - scripts/osc_wrapper: Select repository appropriate for architecture. - scripts: Add kernel_repos. - scripts: obsapi: Kick get_kernel_projects from uploader - scripts: obsapi: Kick get_project_repo_archs from uploader - slab: Introduce kmalloc_obj() and family (bsc#1280139). - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139). - smb3: missing inode locks in punch hole (git-fixes). - smb: client: reject overlapping data areas in SMB2 responses (git-fixes). - xfs: don't drain buffer lru on freeze and read-only remount (bsc#1280223).
Last supporting evidence check: 2026-10-23T01:57:02.493Z UTC
cluster-md-kmp-default 4.12.14-0
dlm-kmp-default 4.12.14-0
gfs2-kmp-default 4.12.14-0
kernel-default 4.12.14-0
kernel-default-base 4.12.14-0
kernel-default-man 4.12.14-0
kernel-source 4.12.14-0
ocfs2-kmp-default 4.12.14-0