⌘ + K

SUSE-SU-2026:5121-1

Dashboard / Vulnerabilities / SUSE-SU-2026:5121-1

SUSE-SU-2026:5121-1

Published: 5 Nov 2026Last Modified: 6 Nov 2026

Upstream:

Aliases:

Summary: Security update for the Linux Kernel

Details: The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918). - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703 bsc#1275737). - CVE-2026-23059: scsi: qla2xxx: Sanitize payload size to prevent member overflow (bsc#1257737 bsc#1275737). - CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860). - CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805). - CVE-2026-64379: smb: client: mask server-provided mode to 07777 in modefromsid (bsc#1273029). - CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082). - CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080). - CVE-2026-64539: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (bsc#1273338). - CVE-2026-64546: drm/edid: fix OOB read in drm_parse_tiled_block() (bsc#1273334). - CVE-2026-64549: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (bsc#1273341). - CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663). - CVE-2026-72310: smb: client: fix overflow in passthrough ioctl bounds check (bsc#1277750). - CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041). - CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050). - CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044). - CVE-2026-74683: Input: evdev - sanitize event type index when fetching event masks (bsc#1277387). - CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574). - CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578). - CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338). - CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode (bsc#1277260). - CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343). - CVE-2026-80704: drm/amd/display: use proper context for logging (bsc#1278431). - CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836). - CVE-2026-80764: Bluetooth: hci_event: fix LE list UAF on reset (bsc#1279493). - CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795). - CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606). - CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write (bsc#1279494). - CVE-2026-80881: ocfs2: fix buffer head management in ocfs2_read_blocks() (bsc#1279496). - CVE-2026-80888: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (bsc#1279455). - CVE-2026-80978: net: cap advertised IP tunnel headroom (bsc#1280253). - CVE-2026-80989: net: thunderbolt: Mark the connection down when bringing it up fails (bsc#1280305). - CVE-2026-89494: ocfs2: validate lengths in dlm_mig_lockres_handler (bsc#1280520). - CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler (bsc#1280569). - CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (bsc#1280713). - CVE-2026-89559: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (bsc#1280554). - CVE-2026-89606: ecryptfs: reject too-small tag 70 packets (bsc#1280469). - CVE-2026-89607: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (bsc#1281792). - CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826). - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496). - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042). - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046). - CVE-2026-89640: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (bsc#1280950). - CVE-2026-89642: cifs: call pagecache_isize_extended() in cifs_setsize() when extending (bsc#1280970). - CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563). - CVE-2026-89821: drm/amd/display: avoid divide-by-zero in __is_lut_linear() (bsc#1280996). - CVE-2026-89842: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started (bsc#1275737 bsc#1281189). - CVE-2026-89843: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (bsc#1275737 bsc#1280984). - CVE-2026-89844: scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition (bsc#1275737 bsc#1281183). - CVE-2026-89845: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (bsc#1275737 bsc#1281001). - CVE-2026-89846: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (bsc#1275737 bsc#1281184). - CVE-2026-89847: scsi: qla2xxx: Avoid double completion in async IOCB timeout (bsc#1275737 bsc#1281185). - CVE-2026-89848: scsi: qla2xxx: Quiesce response IRQ before freeing request queue (bsc#1275737 bsc#1281179). - CVE-2026-89849: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (bsc#1275737 bsc#1281180). - CVE-2026-89850: scsi: qla2xxx: Don't query firmware state while chip is down (bsc#1275737 bsc#1281181). - CVE-2026-89851: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (bsc#1275737 bsc#1281175). - CVE-2026-89852: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (bsc#1275737 bsc#1281174). - CVE-2026-89853: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (bsc#1275737 bsc#1281173). - CVE-2026-89854: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (bsc#1275737 bsc#1281165). - CVE-2026-89855: scsi: qla2xxx: Serialize flash version read in reset handler (bsc#1275737 bsc#1281164). - CVE-2026-89857: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject (bsc#1275737 bsc#1281211). - CVE-2026-89858: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (bsc#1275737 bsc#1281334). - CVE-2026-89859: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (bsc#1275737 bsc#1281333). - CVE-2026-89860: scsi: qla2xxx: Initialize NVMe abort_work once at submission (bsc#1275737 bsc#1281357). - CVE-2026-89861: scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (bsc#1275737 bsc#1281353). - CVE-2026-89862: scsi: qla2xxx: Fix BSG job leak on validate flash image error path (bsc#1275737 bsc#1281214). - CVE-2026-89863: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (bsc#1275737 bsc#1281251). - CVE-2026-89864: scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (bsc#1275737 bsc#1281253). - CVE-2026-89865: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (bsc#1275737 bsc#1281254). - CVE-2026-90015: xhci: fix lost bounce buffers on TDs spanning several ring segments (bsc#1281080). - CVE-2026-90057: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() (bsc#1281650). - CVE-2026-90081: net/rds: use wq_has_sleeper() in rds_cong_map_updated() (bsc#1281490). - CVE-2026-90103: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (bsc#1281538). - CVE-2026-90125: smb: client: fix request buffer leak in smb2_new_read_req() (bsc#1281580). - CVE-2026-90138: vsock: don't check the listener's sk_err in vsock_accept() (bsc#1281535). - CVE-2026-90227: nvme: fine-granular CAP_SYS_ADMIN for nvme io commands (bsc#1281705). - CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993). - CVE-2026-93210: smb: client: harden DFS cache against invalid target hints (bsc#1282737). - CVE-2026-93231: lockd: fix swapped arguments in nlmsvc_match_ip() (bsc#1282778). - CVE-2026-93242: scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (bsc#1275737 bsc#1282684). - CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush() (bsc#1283004). - CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810). - CVE-2026-93785: cifs: validate idmap key payload length (bsc#1282869). - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932). - CVE-2026-93817: perf: Fix addr_filter_ranges lifetime (bsc#1283017). - CVE-2026-97527: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (bsc#1275737 bsc#1283343). - CVE-2026-97528: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (bsc#1275737 bsc#1283360). - CVE-2026-97530: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (bsc#1275737 bsc#1283159). - CVE-2026-97531: scsi: qla2xxx: Skip vport under deletion in report ID acquisition (bsc#1275737 bsc#1283834). - CVE-2026-97535: scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (bsc#1275737 bsc#1283837). - CVE-2026-97537: scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (bsc#1275737 bsc#1283453). - CVE-2026-97612: net: mpls: clear inner_protocol when the last label is popped (bsc#1283967). - CVE-2026-97926: ufs: validate cylinder group metadata before caching it (bsc#1283887). - CVE-2026-97954: net/rds: fix tcp stream corruption with large pages (bsc#1283113). - CVE-2026-97965: vxlan: initialize _md in vxlan_xmit_one() (bsc#1282963). - CVE-2026-98014: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (bsc#1283668). - CVE-2026-98022: net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (bsc#1283810). - CVE-2026-98071: net/rds: clear cp_flags bits individually in rds_conn_path_reset() (bsc#1283842). - CVE-2026-98072: net/rds: use wq_has_sleeper() in release_in_xmit() (bsc#1283846). - CVE-2026-98074: bonding: do not clear curr_active_slave prematurely when releasing all slaves (bsc#1283871). - CVE-2026-98078: ipvs: fix reversed sequence option serialization (bsc#1284150). - CVE-2026-98095: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header() (bsc#1283921). - CVE-2026-98116: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (bsc#1283878). - CVE-2026-98158: ppp_async: drop the errored frame instead of resetting its headroom (bsc#1283933). - CVE-2026-98257: rds: ib: use rds_conn_drop() on protocol version mismatch (bsc#1284346). - CVE-2026-98282: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (bsc#1284360). - CVE-2026-98386: scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot (bsc#1275737 bsc#1285668). - CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685). The following non security issues were fixed: - net/rds: use clear_bit_unlock() in release_refill() (git-fixes). - nvmet-tcp: do not continue for invalid icreq (git-fixes). - ocfs2: reserve xattr value tree metadata only once (git-fixes). - rds: add missing barrier to release_refill (git-fixes). - Revert 'mkspec: Exclude rt flavor from kernel-syms dependencies' (bsc#1244337). - Revert 'rpm/mkspec: Fix missing kernel-syms-rt creation' (bsc#1244337).

Affected packages

Package

Name: kernel-default

Purl: pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012%20SP5

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -4.12.14-122.339.1

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High