Vulnerability-Lookup

SUSE-SU-2026:21834-1

Vulnerability from csaf_suse - Published: 2026-05-28 11:12 - Updated: 2026-09-16 19:51

Summary

Security update for the Linux Kernel

Severity

Important

Notes

Title of the patch: Security update for the Linux Kernel

Description of the patch: The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603). - CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420). - CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471). - CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360). - CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160). - CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837). - CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826). - CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799). - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018). - CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012). - CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538). - CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555). - CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573). - CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505). - CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523). - CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529). - CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526). - CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801). - CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530). - CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811). - CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576). - CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546). - CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566). - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531). - CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728). - CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020). - CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410). - CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617). - CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635). - CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641). - CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768). - CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581). - CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702). - CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779). - CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584). - CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687). - CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703). - CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686). - CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781). - CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692). - CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636). - CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694). - CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788). - CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786). - CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645). - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638). - CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796). - CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629). - CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632). - CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752). - CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099). - CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100). - CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055). - CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061). - CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054). - CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063). - CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053). - CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074). - CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086). - CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087). - CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601). - CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616). - CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617). - CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627). - CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671). - CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673). - CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077). - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085). - CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093). - CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095). - CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752). - CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012). - CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725). - CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662). - CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001). - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758). - CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018). - CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104). - CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107). - CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064). - CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074). - CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176). - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165). - CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048). - CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582). - CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052). - CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131). - CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138). - CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140). - CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141). - CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556). - CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562). - CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592). - CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593). - CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595). - CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596). - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668). - CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604). - CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901). - CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882). - CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059). - CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181). - CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014). - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931). - CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933). - CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995). - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097). - CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942). - CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082). - CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183). - CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233). - CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469). - CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586). - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848). - CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427). - CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085). - CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119). - CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116). - CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674). - CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626). - CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960). The following non security issues were fixed: - accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes). - ACPI: AGDI: fix missing newline in error message (git-fixes). - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes). - ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes). - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes). - ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes). - ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes). - ALSA: 6fire: Fix input volume change detection (git-fixes). - ALSA: 6fire: fix use-after-free on disconnect (git-fixes). - ALSA: aoa: i2sbus: clear stale prepared state (git-fixes). - ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes). - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes). - ALSA: aoa: Use guard() for mutex locks (stable-fixes). - ALSA: asihpi: avoid write overflow check warning (stable-fixes). - ALSA: caiaq: Don't abort when no input device is available (git-fixes). - ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes). - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes). - ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes). - ALSA: caiaq: Handle probe errors properly (git-fixes). - ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes). - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes). - ALSA: core: Fix potential data race at fasync handling (git-fixes). - ALSA: core: Serialize deferred fasync state checks (git-fixes). - ALSA: core: Validate compress device numbers without dynamic minors (git-fixes). - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes). - ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes). - ALSA: ctxfi: Limit PTP to a single page (git-fixes). - ALSA: firewire-tascam: Do not drop unread control events (git-fixes). - ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes). - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes). - ALSA: hda/realtek - fixed speaker no sound update (git-fixes). - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes). - ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes). - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes). - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes). - ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes). - ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes). - ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes). - ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes). - ALSA: misc: Use guard() for spin locks (stable-fixes). - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes). - ALSA: pcmtest: fix reference leak on failed device registration (git-fixes). - ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes). - ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes). - ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes). - ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes). - ALSA: scarlett2: Add missing sentinel initializer field (git-fixes). - ALSA: seq: Notify client and port info changes (stable-fixes). - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes). - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes). - ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes). - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes). - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes). - ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes). - ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes). - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes). - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes). - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes). - ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes). - ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes). - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes). - ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes). - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes). - ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes). - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes). - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes). - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes). - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes). - ASoC: codecs: ab8500: Fix casting of private data (git-fixes). - ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes). - ASoC: cs35l56: Don't use devres to unregister component (git-fixes). - ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes). - ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes). - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes). - ASoC: fsl_easrc: fix comment typo (git-fixes). - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes). - ASoC: fsl_micfil: Add access property for "VAD Detected" (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes). - ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes). - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes). - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes). - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes). - ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes). - ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes). - ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes). - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes). - ASoC: SOF: compress: return the configured codec from get_params (git-fixes). - ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes). - ASoC: SOF: Intel: hda: Place check before dereference (git-fixes). - ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes). - ASoC: sti: Return errors from regmap_field_alloc() (git-fixes). - ASoC: sti: use managed regmap_field allocations (git-fixes). - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes). - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes). - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes). - batman-adv: bla: only purge non-released claims (git-fixes). - batman-adv: bla: prevent use-after-free when deleting claims (git-fixes). - batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes). - batman-adv: fix integer overflow on buff_pos (git-fixes). - batman-adv: hold claim backbone gateways by reference (git-fixes). - batman-adv: reject new tp_meter sessions during teardown (git-fixes). - batman-adv: reject oversized global TT response buffers (git-fixes). - batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes). - bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238). - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes). - Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes). - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996). - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes). - Bluetooth: hci_event: fix memset typo (git-fixes). - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes). - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes). - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes). - Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes). - Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes). - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes). - Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes). - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes). - Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes). - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec (git-fixes). - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes). - Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes). - Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes). - Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes). - bpf: Add third round of bounds deduction (git-fixes). - bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes). - bpf: Improve bounds when s64 crosses sign boundary (git-fixes). - bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes). - btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933). - btrfs: reject root items with drop_progress and zero drop_level (git-fixes). - btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes). - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes). - bus: rifsc: fix RIF configuration check for peripherals (git-fixes). - can: mcp251x: add error handling for power enable in open and resume (stable-fixes). - can: raw: fix ro->uniq use-after-free in raw_rcv() (git-fixes). - can: ucan: fix devres lifetime (git-fixes). - cdc-acm: new quirk for EPSON HMD (stable-fixes). - check-for-config-changes: Exclude CC_MS_EXTENSIONS. - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}. - comedi: dt2815: add hardware detection to prevent crash (stable-fixes). - cpufreq: intel_pstate: Drop Arrow Lake from "scaling factor" list (bsc#1249104). - crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes). - crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes). - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes). - crypto: atmel-ecc - Release client on allocation failure (git-fixes). - crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes). - crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes). - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes). - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes). - crypto: atmel-tdes - fix DMA sync direction (git-fixes). - crypto: ccp - copy IV using skcipher ivsize (git-fixes). - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes). - crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes). - crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238). - crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238). - crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes). - crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238). - crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes). - crypto: iaa - Move compression CRC into request object (jsc#PED-14238). - crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238). - crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238). - crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238). - crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238). - crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238). - crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238). - crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes). - crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes). - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes). - crypto: qat - #undef field_get() before local definition (jsc#PED-14238). - crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238). - crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238). - crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238). - crypto: qat - add compression slice count for rate limiting (jsc#PED-14238). - crypto: qat - add decompression service for rate limiting (jsc#PED-14238). - crypto: qat - add decompression service to telemetry (jsc#PED-14238). - crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238). - crypto: qat - add GEN6 firmware loader (jsc#PED-14238). - crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238). - crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238). - crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238). - crypto: qat - add missing header inclusion (jsc#PED-14238). - crypto: qat - add qat_6xxx driver (jsc#PED-14238). - crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238). - crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238). - crypto: qat - consolidate service enums (jsc#PED-14238). - crypto: qat - Constify struct pm_status_row (jsc#PED-14238). - crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes). - crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes). - crypto: qat - do not export adf_cfg_services (jsc#PED-14238). - crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238). - crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238). - crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238). - crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238). - crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238). - crypto: qat - export adf_get_service_mask() (jsc#PED-14238). - crypto: qat - export adf_init_admin_pm() (jsc#PED-14238). - crypto: qat - expose configuration functions (jsc#PED-14238). - crypto: qat - fix compression instance leak (git-fixes). - crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes). - crypto: qat - fix object goals in Makefiles (jsc#PED-14238. - crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes). - crypto: qat - Fix typo "accelaration" (jsc#PED-14238). - crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238). - crypto: qat - include qat_common in top Makefile (jsc#PED-14238). - crypto: qat - introduce fuse array (jsc#PED-14238). - crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238). - crypto: qat - optimize allocations for fw authentication (jsc#PED-14238). - crypto: qat - refactor compression template logic (jsc#PED-14238). - crypto: qat - refactor FW signing algorithm (jsc#PED-14238). - crypto: qat - refactor ring-related debug functions (jsc#PED-14238). - crypto: qat - refactor service parsing logic (jsc#PED-14238). - crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238). - crypto: qat - relocate bank state helper functions (jsc#PED-14238). - crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238). - crypto: qat - relocate service related functions (jsc#PED-14238). - crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238). - crypto: qat - Remove dst_null support (jsc#PED-14238). - crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238). - crypto: qat - remove initialization in device class (jsc#PED-14238). - crypto: qat - remove redundant FW image size check (jsc#PED-14238). - crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238). - crypto: qat - remove unused members in suof structure (jsc#PED-14238). - crypto: qat - rename and relocate timer logic (jsc#PED-14238). - crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238). - crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238). - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238). - crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238). - crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238). - crypto: qat - set command ids as reserved (jsc#PED-14238). - crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238). - crypto: qat - update firmware api (jsc#PED-14238). - crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238). - crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238). - crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238). - crypto: qat - use swab32 macro (git-fixes). - crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238). - crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238). - crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes). - crypto: simd - reject compat registrations without __ prefixes (git-fixes). - crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes). - crypto: tegra - Disable softirqs before finalizing request (git-fixes). - devres: fix missing node debug info in devm_krealloc() (git-fixes). - dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes). - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes). - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes). - dpll: zl3073x: Add support to adjust phase (bsc#1255752). - dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752). - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752). - dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752). - drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes). - drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes). - drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes). - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes). - drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes). - drm/amd/display: Correct logic check error for fastboot (git-fixes). - drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes). - drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes). - drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes). - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes). - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes). - drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes). - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes). - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes). - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes). - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes). - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes). - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes). - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes). - drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes). - drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes). - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes). - drm/amdgpu/pm: add missing revision check for CI (git-fixes). - drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes). - drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes). - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes). - drm/amdgpu/vce: Prevent partial address patches (stable-fixes). - drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes). - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes). - drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes). - drm/amdgpu: Add default case in DVI mode validation (git-fixes). - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes). - drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes). - drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes). - drm/amdgpu: replace PASID IDR with XArray (git-fixes). - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes). - drm/amdgpu: zero-initialize GART table on allocation (stable-fixes). - drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes). - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes). - drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes). - drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes). - drm/arcpgu: fix device node leak (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes). - drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes). - drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes). - drm/exynos: remove bridge when component_add fails (git-fixes). - drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes). - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes). - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes). - drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes). - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes). - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes). - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes). - drm/i915/wm: Verify the correct plane DDB entry (git-fixes). - drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes). - drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes). - drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes). - drm/loongson: Use managed KMS polling (git-fixes). - drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes). - drm/msm/a6xx: Fix HLSQ register dumping (git-fixes). - drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes). - drm/msm/dpu: fix mismatch between power and frequency (git-fixes). - drm/msm/dsi: add the missing parameter description (git-fixes). - drm/msm/dsi: fix bits_per_pclk (git-fixes). - drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes). - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes). - drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes). - drm/msm/shrinker: Fix can_block() logic (git-fixes). - drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes). - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes). - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes). - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes). - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes). - drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes). - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes). - drm/panthor: Fix outdated function documentation (git-fixes). - drm/radeon: add missing revision check for CI (git-fixes). - drm/sun4i: backend: fix error pointer dereference (git-fixes). - drm/sun4i: Fix resource leaks (git-fixes). - drm/v3d: Handle error from drm_sched_entity_init() (git-fixes). - drm/vc4: Fix a memory leak in hang state error path (git-fixes). - drm/vc4: Fix memory leak of BO array in hang state (git-fixes). - drm/vc4: platform_get_irq_byname() returns an int (stable-fixes). - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes). - drm/vc4: Release runtime PM reference after binding V3D (git-fixes). - drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes). - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes). - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes). - drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes). - drm/xe/dma-buf: handle empty bo and UAF races (git-fixes). - drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes). - drm/xe/uapi: update used tracking kernel-doc (git-fixes). - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes). - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes). - dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes). - efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes). - efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes). - erofs: add GFP_NOIO in the bio completion if needed (git-fixes). - ext4: fix fsync(2) for nojournal mode (git-fixes). - ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes). - ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes). - extcon: Fixed sysfs duplicate filename issue (git-fixes). - extcon: ptn5150: handle pending IRQ events during system resume (git-fixes). - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes). - fbdev: offb: fix PCI device reference leak on probe failure (git-fixes). - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes). - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes). - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes). - firmware: dmi: Correct an indexing error in dmi.h (git-fixes). - firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes). - firmware: google: framebuffer: Do not unregister platform device (git-fixes). - gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes). - gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes). - gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes). - HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes). - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes). - HID: apple: ensure the keyboard backlight is off if suspending (git-fixes). - HID: asus: do not abort probe when not necessary (git-fixes). - HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes). - HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes). - HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes). - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes). - HID: multitouch: Check to ensure report responses match the request (stable-fixes). - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes). - HID: roccat: fix use-after-free in roccat_report_event (stable-fixes). - HID: usbhid: fix deadlock in hid_post_reset() (git-fixes). - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes). - hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes). - hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes). - hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes). - hv_sock: fix ARM64 support (git-fixes). - hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes). - hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes). - hwmon: (corsair-psu) Close HID device on probe errors (git-fixes). - hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes). - hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes). - hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes). - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") (git-fixes). - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes). - hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes). - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes). - i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes). - i2c: smbus: reject oversized block transfers in the common path (git-fixes). - i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes). - i2c: stub: Reject I2C block transfers with invalid length (git-fixes). - i2c: tegra: Add HS mode support (bsc#1261550). - i2c: tegra: Add Tegra256 support (bsc#1261550). - i2c: tegra: Do not configure DMA if not supported (bsc#1261550). - i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes). - i2c: tegra: Update Tegra256 timing parameters (bsc#1261550). - i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550). - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes). - i3c: master: Fix error codes at send_ccc_cmd (git-fixes). - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes). - ibmveth: Disable GSO for packets with small MSS (bsc#1265144). - iio: adc: ad7192: Revert "properly check spi_get_device_match_data()" (stable-fixes). - iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes). - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes). - iio: frequency: admv1013: add dev variable (stable-fixes). - iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes). - Input: bcm5974 - recover from failed mode switch (stable-fixes). - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes). - Input: uinput - fix circular locking dependency with ff-core (git-fixes). - Input: uinput - take event lock when submitting FF request "event" (stable-fixes). - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes). - Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes). - interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes). - io_uring/timeout: check unused sqe fields (git-fixes). - iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593). - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593). - iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113). - ipmi: Add limits to event and receive message requests (git-fixes). - ipmi: Check event message buffer response for bad data (git-fixes). - ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes). - ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes). - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes). - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes). - KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes). - KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes). - KVM: arm64: Block cacheable PFNMAP mapping (git-fixes). - KVM: arm64: Consolidate idreg callbacks (git-fixes). - KVM: arm64: Discard PC update state on vcpu reset (git-fixes). - KVM: arm64: Finalize ID registers only once per VM (git-fixes). - KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes). - KVM: arm64: Fix page leak in user_mem_abort() (git-fixes). - KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes). - KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes). - KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes). - KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes). - KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes). - KVM: arm64: Make all 32bit ID registers fully writable (git-fixes). - KVM: arm64: nv: Add trap config for DBGWCR<15>_EL1 (git-fixes). - KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes). - KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes). - KVM: arm64: Read PMUVer as unsigned (git-fixes). - KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes). - KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes). - KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes). - KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes). - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes). - KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes). - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes). - KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes). - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes). - KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes). - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (git-fixes). - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes). - KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes). - KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes). - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes). - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes). - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes). - KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes). - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes). - KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes). - KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes). - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes). - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes). - KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes). - KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes). - KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes). - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes). - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes). - KVM: x86: Ignore cpuid faulting in SMM (git-fixes). - leds: lgm-sso: Remove duplicate assignments for priv->mmap (git-fixes). - leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes). - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes). - md/raid1: fix the comparing region of interval tree (bsc#1261555). - md/raid1: serialize overlap io for writemostly disk (bsc#1261555). - media: amphion: Fix race between m2m job_abort and device_run (git-fixes). - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes). - media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes). - media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes). - media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes). - media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes). - media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes). - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes). - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes). - media: i2c: imx283: Enter full standby when stopping streaming (git-fixes). - media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes). - media: i2c: imx412: Assert reset GPIO during probe (git-fixes). - media: i2c: ov08d10: fix image vertical start setting (git-fixes). - media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes). - media: intel/ipu6: fix error pointer dereference (git-fixes). - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes). - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes). - media: omap3isp: drop the use count of v4l2 pipeline (git-fixes). - media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes). - media: rc: streamzap: Error handling in probe (git-fixes). - media: rc: xbox_remote: heed DMA restrictions (git-fixes). - media: saa7164: add ioremap return checks and cleanups (git-fixes). - media: staging: imx: configure src_mux in csi_start (git-fixes). - media: staging: imx: request mbus_config in csi_start (git-fixes). - media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes). - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes). - media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes). - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes). - media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes). - memory: tegra30-emc: Fix dll_change check (git-fixes). - memory: tegra124-emc: Fix dll_change check (git-fixes). - mfd: core: Preserve OF node when ACPI handle is present (git-fixes). - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes). - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes). - mkspec: Add signature to source list only when it exists. - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes). - mmc: vub300: fix NULL-deref on disconnect (git-fixes). - modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199). - mtd: docg3: fix use-after-free in docg3_release() (git-fixes). - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes). - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes). - mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes). - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes). - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes). - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes). - mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes). - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes). - net-shapers: don't free reply skb after genlmsg_reply() (git-fixes). - net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes). - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626). - net/sched: cls_fw: fix NULL dereference of "old" filters before change() (git-fixes). - net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421). - net: gro: don't merge zcopy skbs (git-fixes). - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes). - net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes). - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes). - net: mana: Don't overwrite port probe error with add_adev result (git-fixes). - net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846). - net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes). - net: mana: Fix RX skb truesize accounting (bsc#1248754). - net: mana: Guard mana_remove against double invocation (git-fixes). - net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes). - net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes). - net: mana: Init gf_stats_work before potential error paths in probe (git-fixes). - net: mana: Init link_change_work before potential error paths in probe (git-fixes). - net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes). - net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes). - net: mana: Set default number of queues to 16 (bsc#1261648). - net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes). - net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes). - net: mana: Use pci_name() for debugfs directory naming (git-fixes). - net: phy: broadcom: Save PHY counters during suspend (git-fixes). - net: phy: DP83TC811: add reading of abilities (git-fixes). - net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes). - net: phy: fix a return path in get_phy_c45_ids() (git-fixes). - net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes). - net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes). - net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes). - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes). - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes). - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes). - net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes). - net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes). - net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes). - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes). - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes). - nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes). - nfc: pn533: allocate rx skb before consuming bytes (git-fixes). - nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes). - NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes). - nvme-apple: drop invalid put of admin queue reference count (git-fixes). - nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428). - nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709). - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes). - nvme: Allow reauth from sysfs (bsc#1259672). - nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672). - nvme: expose TLS mode (bsc#1259672). - nvme: fix admin queue leak on controller reset (git-fixes). - nvme: fix PCIe subsystem reset controller state transition (bsc#1261738). - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes). - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718). - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718). - openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes). - panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149). - panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149). - panic: introduce helper functions for panic state (bsc#1261149). - panic: use angle-bracket include for panic.h (bsc#1261149). - PCI/AER: Clear only error bits in PCIe Device Status (git-fixes). - PCI/AER: Stop ruling out unbound devices as error source (git-fixes). - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes). - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes). - PCI/TPH: Allow TPH enable for RCiEPs (git-fixes). - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes). - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes). - PCI: Enable AtomicOps only if Root Port supports them (git-fixes). - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes). - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes). - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes). - PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648). - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes). - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes). - PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes). - PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes). - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes). - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes). - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes). - PCI: tegra194: Fix polling delay for L2 state (git-fixes). - PCI: tegra194: Free up Endpoint resources during remove() (git-fixes). - PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes). - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes). - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" (git-fixes). - PCI: tegra194: Use DWC IP core version (git-fixes). - pinctrl: abx500: Fix type of 'argument' variable (git-fixes). - pinctrl: Fix spelling problem (git-fixes). - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes). - pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes). - pinctrl: pic32: use consistent spacing around '+' (git-fixes). - pinctrl: pinctrl-pic32: Fix resource leak (git-fixes). - pinctrl: realtek: Fix function signature for config argument (git-fixes). - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes). - platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes). - platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes). - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes). - platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes). - platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes). - platform/x86: asus-wmi: fix screenpad brightness range (git-fixes). - platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes). - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes). - platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes). - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes). - power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes). - power: supply: max17042: avoid overflow when determining health (git-fixes). - powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535). - powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535). - printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149). - printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149). - printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149). - printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149). - printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149). - printk: Allow printk_trigger_flush() to flush all types (bsc#1262750). - printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912). - printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750). - printk: Avoid scheduling irq_work on suspend (bsc#1262750). - printk: console_flush_one_record() code cleanup (bsc#1261149). - printk: Introduce console_flush_one_record (bsc#1261149). - printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149). - pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes). - qat: don't mess with ->d_name (jsc#PED-14238). - r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes). - RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes). - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Validate rx_hash_key_len (git-fixes). - RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes). - RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes). - RDMA/mana_ib: Support memory windows (git-fixes). - regulator: act8945a: fix OF node reference imbalance (git-fixes). - regulator: bd9571mwv: fix OF node reference imbalance (git-fixes). - regulator: max77650: fix OF node reference imbalance (git-fixes). - regulator: mt6357: fix OF node reference imbalance (git-fixes). - regulator: rk808: fix OF node reference imbalance (git-fixes). - remoteproc: xlnx: Fix sram property parsing (git-fixes). - remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes). - Revert "ALSA: usb: Increase volume range that triggers a warning" (git-fixes). - Revert "serial: 8250: Revert "drop lockdep annotation from serial8250_clear_IER()"" (bsc#1262480). - Revert "serial: 8250: Switch to nbcon console" (bsc#1262480). - rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes). - rtc: ntxec: fix OF node reference imbalance (git-fixes). - s390/dasd: Copy detected format information to secondary device (bsc#1259994). - s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994). - s390/dasd: Move quiesce state with pprc swap (bsc#1259994). - sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961). - sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961). - sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961). - scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019). - scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019). - scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019). - scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019). - scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019). - scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019). - scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019). - scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019). - scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019). - scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019). - scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019). - scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019). - scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019). - scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019). - scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019). - scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019). - scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019). - scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019). - scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019). - scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019). - scsi: lpfc: Update copyright year string for 2026 (bsc#1262019). - scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019). - scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019). - scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019). - scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019). - scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019). - scsi: lpfc: Use the crc32c() function (bsc#1262019). - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes). - scsi: ses: Fix devices attaching to different hosts (git-fixes). - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes). - scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449). - scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771). - selftests/bpf: Test cross-sign 64bits range refinement (git-fixes). - selftests/bpf: Test invariants on JSLT crossing sign (git-fixes). - selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes). - selftests: net: build net/lib dependency in all target (bsc#1262245). - selinux: don't reserve xattr slot when we won't fill it (stable-fixes). - selinux: prune /sys/fs/selinux/disable (stable-fixes). - selinux: shrink critical section in sel_write_load() (stable-fixes). - serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480). - serial: 8250: Protect LCR write in shutdown (bsc#1262480). - serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480). - serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480). - serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480). - serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480). - Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044). - soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes). - soc: qcom: aoss: compare against normalized cooling state (git-fixes). - soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes). - soc: qcom: ocmem: make the core clock optional (git-fixes). - soc: qcom: ocmem: register reasons for probe deferrals (git-fixes). - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes). - sound: ua101: fix division by zero at probe (git-fixes). - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes). - soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes). - soundwire: debugfs: initialize firmware_file to empty string (git-fixes). - spi: aspeed-smc: fix controller deregistration (git-fixes). - spi: at91-usart: fix controller deregistration (git-fixes). - spi: atmel: fix controller deregistration (git-fixes). - spi: bcm63xx: fix controller deregistration (git-fixes). - spi: bcmbca-hsspi: fix controller deregistration (git-fixes). - spi: cadence: fix controller deregistration (git-fixes). - spi: cadence: fix unclocked access on unbind (git-fixes). - spi: ch341: fix memory leaks on probe failures (git-fixes). - spi: coldfire-qspi: fix controller deregistration (git-fixes). - spi: dln2: fix controller deregistration (git-fixes). - spi: fix controller cleanup() documentation (git-fixes). - spi: fix misleading controller deregistration kernel-doc (git-fixes). - spi: fix misleading controller registration kernel-doc (git-fixes). - spi: fsl-espi: fix controller deregistration (git-fixes). - spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes). - spi: fsl: fix controller deregistration (git-fixes). - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes). - spi: img-spfi: fix controller deregistration (git-fixes). - spi: imx: fix runtime pm leak on probe deferral (git-fixes). - spi: imx: fix use-after-free on unbind (git-fixes). - spi: lantiq-ssc: fix controller deregistration (git-fixes). - spi: meson-spicc: fix controller deregistration (git-fixes). - spi: microchip-core-qspi: fix controller deregistration (git-fixes). - spi: mpc52xx: fix controller deregistration (git-fixes). - spi: mpc52xx: fix use-after-free on registration failure (git-fixes). - spi: mpc52xx: fix use-after-free on unbind (git-fixes). - spi: mtk-nor: fix controller deregistration (git-fixes). - spi: mtk-snfi: fix memory leak in probe (git-fixes). - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes). - spi: mxic: fix controller deregistration (git-fixes). - spi: mxs: fix controller deregistration (git-fixes). - spi: npcm-pspi: fix controller deregistration (git-fixes). - spi: omap2-mcspi: fix controller deregistration (git-fixes). - spi: orion: fix clock imbalance on registration failure (git-fixes). - spi: orion: fix controller deregistration (git-fixes). - spi: orion: fix runtime pm leak on unbind (git-fixes). - spi: pic32-sqi: fix controller deregistration (git-fixes). - spi: pic32: fix controller deregistration (git-fixes). - spi: pl022: fix controller deregistration (git-fixes). - spi: qup: fix controller deregistration (git-fixes). - spi: rockchip: fix controller deregistration (git-fixes). - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes). - spi: rspi: fix controller deregistration (git-fixes). - spi: s3c64xx: fix controller deregistration (git-fixes). - spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes). - spi: sh-hspi: fix controller deregistration (git-fixes). - spi: sprd: fix controller deregistration (git-fixes). - spi: st-ssc4: fix controller deregistration (git-fixes). - spi: sun4i: fix controller deregistration (git-fixes). - spi: sun6i: fix controller deregistration (git-fixes). - spi: syncuacer: fix controller deregistration (git-fixes). - spi: ti-qspi: fix controller deregistration (git-fixes). - spi: topcliff-pch: fix controller deregistration (git-fixes). - spi: topcliff-pch: fix use-after-free on unbind (git-fixes). - spi: uniphier: fix controller deregistration (git-fixes). - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes). - spi: zynq-qspi: fix controller deregistration (git-fixes). - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes). - spi: zynqmp-gqspi: fix controller deregistration (git-fixes). - staging: media: atomisp: Disallow all private IOCTLs (git-fixes). - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes). - staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes). - staging: vme_user: fix root device leak on init failure (git-fixes). - tg3: replace placeholder MAC address with device property (git-fixes). - thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes). - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes). - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes). - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes). - tools: hv: Fix cross-compilation (git-fixes). - tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes). - tpm: avoid -Wunused-but-set-variable (git-fixes). - tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes). - tpm: tpm_tis: add error logging for data transfer (git-fixes). - tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes). - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes). - tty: serial: ip22zilog: Fix section mispatch warning (git-fixes). - udp: Force compute_score to always inline (bsc#1241259). - unshare: fix unshare_fs() handling (git-fixes). - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes). - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes). - usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes). - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes). - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes). - usb: gadget: f_hid: Add missing error code (git-fixes). - usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes). - usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes). - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes). - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes). - usb: gadget: f_uac1_legacy: validate control request size (stable-fixes). - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes). - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes). - USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes). - usb: port: add delay after usb_hub_set_port_power() (git-fixes). - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes). - USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes). - USB: serial: option: add MeiG Smart SRM825WN (stable-fixes). - USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes). - USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes). - USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes). - usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes). - usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes). - usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes). - usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes). - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes). - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes). - usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes). - vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes). - vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes). - vfio/pds: Fix missing detach_ioas op (git-fixes). - vfio/pds: replace bitmap_free with vfree (git-fixes). - vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes). - vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes). - vfio: Prevent open_count decrement to negative (git-fixes). - virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes). - virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes). - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes). - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - wifi: ath5k: do not access array OOB (git-fixes). - wifi: ath9k: Fix typo (git-fixes). - wifi: ath10k: fix station lookup failure during disconnect (git-fixes). - wifi: ath11k: fix memory leaks in beacon template setup (git-fixes). - wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes). - wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes). - wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes). - wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes). - wifi: brcmfmac: Fix error pointer dereference (git-fixes). - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes). - wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes). - wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes). - wifi: cw1200: Revert "Fix locking in error paths" (git-fixes). - wifi: libertas: notify firmware load wait on disconnect (git-fixes). - wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes). - wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes). - wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes). - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes). - wifi: mac80211: remove station if connection prep fails (git-fixes). - wifi: mac80211: use safe list iteration in radar detect work (git-fixes). - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes). - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes). - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes). - wifi: mt76: mt7615: fix use_cts_prot support (git-fixes). - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes). - wifi: mt76: mt7915: fix use_cts_prot support (git-fixes). - wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes). - wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes). - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes). - wifi: mt76: mt7921: Place upper limit on station AID (git-fixes). - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes). - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes). - wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes). - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes). - wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes). - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes). - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes). - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes). - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes). - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes). - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes). - wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes). - wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes). - wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes). - wifi: rt2x00usb: fix devres lifetime (git-fixes). - wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes). - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes). - wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135). - wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135). - wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135). - wifi: rtw88: check for PCI upstream bridge existence (git-fixes). - wifi: rtw88: fix device leak on probe failure (git-fixes). - wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135). - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes). - wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes). - x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes). - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes). - x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes). - x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes). - x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255). - x86/cpufeatures: Free up unused feature bits (bsc#1263255). - x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes). - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes). - x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes). - x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes). - x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes). - x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes). - x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes). - x86/sev: Make sure pages are not skipped during kdump (git-fixes). - x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044). - x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044). - x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes). - X.509: Fix out-of-bounds access when parsing extensions (git-fixes). - Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).

Patchnames: SUSE-SLE-Micro-Extras-6.2-814

CVE-2023-20585

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-obs-build-6.12.0-160000.33.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-obs-build-6.12.0-160000.33.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-obs-build-6.12.0-160000.33.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-obs-build-6.12.0-160000.33.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-syms-6.12.0-160000.33.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-syms-6.12.0-160000.33.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-syms-6.12.0-160000.33.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro Extras 6.2:kernel-syms-6.12.0-160000.33.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2024-14027

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-40181

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-40219

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-68265

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-68310

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-71238

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-71268

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-71269

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2025-71302

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23168

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23209

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23236

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23237

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23245

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23246

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23253

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23260

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact low

CVE-2026-23261

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact low

CVE-2026-23264

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23266

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23268

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23269

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23271

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23273

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23276

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23279

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23290

4.6 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23291

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23298

4.6 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23300

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23307

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23312

4.6 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23313

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23315

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23316

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23317

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23318

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23321

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23324

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23325

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23334

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23336

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23339

3.1 (Low)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact low

CVE-2026-23340

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23346

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23347

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23351

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23354

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23357

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23360

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23362

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23363

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23365

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23367

6.3 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23368

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23369

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23370

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23372

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23373

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23374

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23375

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23378

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23382

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23387

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23391

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23392

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23395

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23396

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23397

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23399

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23401

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23403

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23404

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23405

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23406

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23407

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23408

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23409

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23410

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23411

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23417

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23418

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23420

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23426

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23434

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23436

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23437

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23440

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23441

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23442

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23443

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23445

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23446

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23447

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23448

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23449

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23450

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23452

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23454

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23455

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23456

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23457

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23458

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23460

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23461

7.5 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23462

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-23463

0 (None)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23464

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23465

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23466

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23468

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23470

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23472

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23473

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23474

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-23475

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31389

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31392

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31393

4.3 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31394

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31395

6.4 (Medium)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31400

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31402

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31403

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31405

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31406

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31407

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31408

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31411

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31412

6.8 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31415

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31416

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact low

CVE-2026-31417

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31420

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31421

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31422

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31423

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31424

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31425

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31426

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31427

4.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31428

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31435

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31449

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31453

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31456

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31470

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31494

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31496

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact low

CVE-2026-31503

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31504

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31505

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31507

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31515

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31519

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31525

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31526

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31528

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31533

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31547

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31550

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31554

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31565

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31579

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31586

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31588

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31644

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31649

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31658

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31662

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31666

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31668

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31669

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31675

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31678

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31679

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31681

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31682

4.3 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31684

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31685

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31691

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-31694

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31700

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31738

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-31787

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43009

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43025

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43027

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43037

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43038

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43045

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43050

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43060

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43082

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43088

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43153

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43190

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43265

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43329

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43365

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43366

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43441

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact moderate

CVE-2026-43494

8.4 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-43503

8.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

CVE-2026-46333

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2023-20585

Threats

Impact important

References

933 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1215199	self
https://bugzilla.suse.com/1234634	self
https://bugzilla.suse.com/1241259	self
https://bugzilla.suse.com/1243603	self
https://bugzilla.suse.com/1248754	self
https://bugzilla.suse.com/1249104	self
https://bugzilla.suse.com/1250951	self
https://bugzilla.suse.com/1253471	self
https://bugzilla.suse.com/1254518	self
https://bugzilla.suse.com/1255160	self
https://bugzilla.suse.com/1255360	self
https://bugzilla.suse.com/1255459	self
https://bugzilla.suse.com/1255752	self
https://bugzilla.suse.com/1256288	self
https://bugzilla.suse.com/1256865	self
https://bugzilla.suse.com/1256867	self
https://bugzilla.suse.com/1258518	self
https://bugzilla.suse.com/1258718	self
https://bugzilla.suse.com/1258826	self
https://bugzilla.suse.com/1258849	self
https://bugzilla.suse.com/1258850	self
https://bugzilla.suse.com/1258854	self
https://bugzilla.suse.com/1258855	self
https://bugzilla.suse.com/1258856	self
https://bugzilla.suse.com/1258857	self
https://bugzilla.suse.com/1258933	self
https://bugzilla.suse.com/1258961	self
https://bugzilla.suse.com/1259186	self
https://bugzilla.suse.com/1259199	self
https://bugzilla.suse.com/1259222	self
https://bugzilla.suse.com/1259420	self
https://bugzilla.suse.com/1259461	self
https://bugzilla.suse.com/1259535	self
https://bugzilla.suse.com/1259672	self
https://bugzilla.suse.com/1259799	self
https://bugzilla.suse.com/1259806	self
https://bugzilla.suse.com/1259857	self
https://bugzilla.suse.com/1259865	self
https://bugzilla.suse.com/1259868	self
https://bugzilla.suse.com/1259869	self
https://bugzilla.suse.com/1259871	self
https://bugzilla.suse.com/1259873	self
https://bugzilla.suse.com/1259878	self
https://bugzilla.suse.com/1259889	self
https://bugzilla.suse.com/1259994	self
https://bugzilla.suse.com/1260010	self
https://bugzilla.suse.com/1260012	self
https://bugzilla.suse.com/1260018	self
https://bugzilla.suse.com/1260428	self
https://bugzilla.suse.com/1260468	self
https://bugzilla.suse.com/1260483	self
https://bugzilla.suse.com/1260484	self
https://bugzilla.suse.com/1260485	self
https://bugzilla.suse.com/1260489	self
https://bugzilla.suse.com/1260504	self
https://bugzilla.suse.com/1260505	self
https://bugzilla.suse.com/1260507	self
https://bugzilla.suse.com/1260514	self
https://bugzilla.suse.com/1260523	self
https://bugzilla.suse.com/1260526	self
https://bugzilla.suse.com/1260528	self
https://bugzilla.suse.com/1260529	self
https://bugzilla.suse.com/1260530	self
https://bugzilla.suse.com/1260531	self
https://bugzilla.suse.com/1260532	self
https://bugzilla.suse.com/1260533	self
https://bugzilla.suse.com/1260536	self
https://bugzilla.suse.com/1260537	self
https://bugzilla.suse.com/1260538	self
https://bugzilla.suse.com/1260541	self
https://bugzilla.suse.com/1260546	self
https://bugzilla.suse.com/1260549	self
https://bugzilla.suse.com/1260551	self
https://bugzilla.suse.com/1260552	self
https://bugzilla.suse.com/1260555	self
https://bugzilla.suse.com/1260561	self
https://bugzilla.suse.com/1260562	self
https://bugzilla.suse.com/1260566	self
https://bugzilla.suse.com/1260571	self
https://bugzilla.suse.com/1260572	self
https://bugzilla.suse.com/1260573	self
https://bugzilla.suse.com/1260576	self
https://bugzilla.suse.com/1260580	self
https://bugzilla.suse.com/1260581	self
https://bugzilla.suse.com/1260593	self
https://bugzilla.suse.com/1260613	self
https://bugzilla.suse.com/1260728	self
https://bugzilla.suse.com/1260729	self
https://bugzilla.suse.com/1260731	self
https://bugzilla.suse.com/1260798	self
https://bugzilla.suse.com/1260800	self
https://bugzilla.suse.com/1260801	self
https://bugzilla.suse.com/1260807	self
https://bugzilla.suse.com/1260811	self
https://bugzilla.suse.com/1260996	self
https://bugzilla.suse.com/1261020	self
https://bugzilla.suse.com/1261149	self
https://bugzilla.suse.com/1261287	self
https://bugzilla.suse.com/1261288	self
https://bugzilla.suse.com/1261295	self
https://bugzilla.suse.com/1261348	self
https://bugzilla.suse.com/1261410	self
https://bugzilla.suse.com/1261503	self
https://bugzilla.suse.com/1261504	self
https://bugzilla.suse.com/1261505	self
https://bugzilla.suse.com/1261550	self
https://bugzilla.suse.com/1261555	self
https://bugzilla.suse.com/1261581	self
https://bugzilla.suse.com/1261582	self
https://bugzilla.suse.com/1261584	self
https://bugzilla.suse.com/1261585	self
https://bugzilla.suse.com/1261592	self
https://bugzilla.suse.com/1261601	self
https://bugzilla.suse.com/1261602	self
https://bugzilla.suse.com/1261617	self
https://bugzilla.suse.com/1261618	self
https://bugzilla.suse.com/1261629	self
https://bugzilla.suse.com/1261632	self
https://bugzilla.suse.com/1261635	self
https://bugzilla.suse.com/1261636	self
https://bugzilla.suse.com/1261637	self
https://bugzilla.suse.com/1261638	self
https://bugzilla.suse.com/1261641	self
https://bugzilla.suse.com/1261644	self
https://bugzilla.suse.com/1261645	self
https://bugzilla.suse.com/1261648	self
https://bugzilla.suse.com/1261679	self
https://bugzilla.suse.com/1261685	self
https://bugzilla.suse.com/1261686	self
https://bugzilla.suse.com/1261687	self
https://bugzilla.suse.com/1261692	self
https://bugzilla.suse.com/1261694	self
https://bugzilla.suse.com/1261700	self
https://bugzilla.suse.com/1261702	self
https://bugzilla.suse.com/1261703	self
https://bugzilla.suse.com/1261707	self
https://bugzilla.suse.com/1261710	self
https://bugzilla.suse.com/1261713	self
https://bugzilla.suse.com/1261714	self
https://bugzilla.suse.com/1261719	self
https://bugzilla.suse.com/1261738	self
https://bugzilla.suse.com/1261750	self
https://bugzilla.suse.com/1261751	self
https://bugzilla.suse.com/1261752	self
https://bugzilla.suse.com/1261768	self
https://bugzilla.suse.com/1261778	self
https://bugzilla.suse.com/1261779	self
https://bugzilla.suse.com/1261780	self
https://bugzilla.suse.com/1261781	self
https://bugzilla.suse.com/1261786	self
https://bugzilla.suse.com/1261788	self
https://bugzilla.suse.com/1261789	self
https://bugzilla.suse.com/1261796	self
https://bugzilla.suse.com/1261797	self
https://bugzilla.suse.com/1261896	self
https://bugzilla.suse.com/1262019	self
https://bugzilla.suse.com/1262053	self
https://bugzilla.suse.com/1262054	self
https://bugzilla.suse.com/1262055	self
https://bugzilla.suse.com/1262061	self
https://bugzilla.suse.com/1262063	self
https://bugzilla.suse.com/1262074	self
https://bugzilla.suse.com/1262078	self
https://bugzilla.suse.com/1262086	self
https://bugzilla.suse.com/1262087	self
https://bugzilla.suse.com/1262099	self
https://bugzilla.suse.com/1262100	self
https://bugzilla.suse.com/1262101	self
https://bugzilla.suse.com/1262179	self
https://bugzilla.suse.com/1262181	self
https://bugzilla.suse.com/1262245	self
https://bugzilla.suse.com/1262250	self
https://bugzilla.suse.com/1262480	self
https://bugzilla.suse.com/1262601	self
https://bugzilla.suse.com/1262616	self
https://bugzilla.suse.com/1262617	self
https://bugzilla.suse.com/1262627	self
https://bugzilla.suse.com/1262662	self
https://bugzilla.suse.com/1262665	self
https://bugzilla.suse.com/1262671	self
https://bugzilla.suse.com/1262673	self
https://bugzilla.suse.com/1262709	self
https://bugzilla.suse.com/1262725	self
https://bugzilla.suse.com/1262731	self
https://bugzilla.suse.com/1262750	self
https://bugzilla.suse.com/1262752	self
https://bugzilla.suse.com/1262758	self
https://bugzilla.suse.com/1263001	self
https://bugzilla.suse.com/1263012	self
https://bugzilla.suse.com/1263018	self
https://bugzilla.suse.com/1263044	self
https://bugzilla.suse.com/1263048	self
https://bugzilla.suse.com/1263052	self
https://bugzilla.suse.com/1263064	self
https://bugzilla.suse.com/1263074	self
https://bugzilla.suse.com/1263077	self
https://bugzilla.suse.com/1263085	self
https://bugzilla.suse.com/1263093	self
https://bugzilla.suse.com/1263095	self
https://bugzilla.suse.com/1263104	self
https://bugzilla.suse.com/1263107	self
https://bugzilla.suse.com/1263131	self
https://bugzilla.suse.com/1263135	self
https://bugzilla.suse.com/1263138	self
https://bugzilla.suse.com/1263140	self
https://bugzilla.suse.com/1263141	self
https://bugzilla.suse.com/1263165	self
https://bugzilla.suse.com/1263176	self
https://bugzilla.suse.com/1263255	self
https://bugzilla.suse.com/1263556	self
https://bugzilla.suse.com/1263562	self
https://bugzilla.suse.com/1263582	self
https://bugzilla.suse.com/1263592	self
https://bugzilla.suse.com/1263593	self
https://bugzilla.suse.com/1263595	self
https://bugzilla.suse.com/1263596	self
https://bugzilla.suse.com/1263604	self
https://bugzilla.suse.com/1263668	self
https://bugzilla.suse.com/1263815	self
https://bugzilla.suse.com/1263882	self
https://bugzilla.suse.com/1263901	self
https://bugzilla.suse.com/1263931	self
https://bugzilla.suse.com/1263933	self
https://bugzilla.suse.com/1263942	self
https://bugzilla.suse.com/1263995	self
https://bugzilla.suse.com/1264014	self
https://bugzilla.suse.com/1264059	self
https://bugzilla.suse.com/1264082	self
https://bugzilla.suse.com/1264097	self
https://bugzilla.suse.com/1264183	self
https://bugzilla.suse.com/1264233	self
https://bugzilla.suse.com/1264427	self
https://bugzilla.suse.com/1264469	self
https://bugzilla.suse.com/1264586	self
https://bugzilla.suse.com/1264674	self
https://bugzilla.suse.com/1264837	self
https://bugzilla.suse.com/1264848	self
https://bugzilla.suse.com/1265085	self
https://bugzilla.suse.com/1265116	self
https://bugzilla.suse.com/1265119	self
https://bugzilla.suse.com/1265144	self
https://bugzilla.suse.com/1265308	self
https://bugzilla.suse.com/1265421	self
https://bugzilla.suse.com/1265449	self
https://bugzilla.suse.com/1265456	self
https://bugzilla.suse.com/1265626	self
https://bugzilla.suse.com/1265846	self
https://bugzilla.suse.com/1265960	self
https://www.suse.com/security/cve/CVE-2023-20585/	self
https://www.suse.com/security/cve/CVE-2024-14027/	self
https://www.suse.com/security/cve/CVE-2025-40181/	self
https://www.suse.com/security/cve/CVE-2025-40219/	self
https://www.suse.com/security/cve/CVE-2025-68265/	self
https://www.suse.com/security/cve/CVE-2025-68310/	self
https://www.suse.com/security/cve/CVE-2025-71238/	self
https://www.suse.com/security/cve/CVE-2025-71268/	self
https://www.suse.com/security/cve/CVE-2025-71269/	self
https://www.suse.com/security/cve/CVE-2025-71302/	self
https://www.suse.com/security/cve/CVE-2026-23168/	self
https://www.suse.com/security/cve/CVE-2026-23209/	self
https://www.suse.com/security/cve/CVE-2026-23236/	self
https://www.suse.com/security/cve/CVE-2026-23237/	self
https://www.suse.com/security/cve/CVE-2026-23245/	self
https://www.suse.com/security/cve/CVE-2026-23246/	self
https://www.suse.com/security/cve/CVE-2026-23253/	self
https://www.suse.com/security/cve/CVE-2026-23260/	self
https://www.suse.com/security/cve/CVE-2026-23261/	self
https://www.suse.com/security/cve/CVE-2026-23264/	self
https://www.suse.com/security/cve/CVE-2026-23266/	self
https://www.suse.com/security/cve/CVE-2026-23268/	self
https://www.suse.com/security/cve/CVE-2026-23269/	self
https://www.suse.com/security/cve/CVE-2026-23271/	self
https://www.suse.com/security/cve/CVE-2026-23273/	self
https://www.suse.com/security/cve/CVE-2026-23276/	self
https://www.suse.com/security/cve/CVE-2026-23279/	self
https://www.suse.com/security/cve/CVE-2026-23290/	self
https://www.suse.com/security/cve/CVE-2026-23291/	self
https://www.suse.com/security/cve/CVE-2026-23298/	self
https://www.suse.com/security/cve/CVE-2026-23300/	self
https://www.suse.com/security/cve/CVE-2026-23307/	self
https://www.suse.com/security/cve/CVE-2026-23312/	self
https://www.suse.com/security/cve/CVE-2026-23313/	self
https://www.suse.com/security/cve/CVE-2026-23315/	self
https://www.suse.com/security/cve/CVE-2026-23316/	self
https://www.suse.com/security/cve/CVE-2026-23317/	self
https://www.suse.com/security/cve/CVE-2026-23318/	self
https://www.suse.com/security/cve/CVE-2026-23321/	self
https://www.suse.com/security/cve/CVE-2026-23324/	self
https://www.suse.com/security/cve/CVE-2026-23325/	self
https://www.suse.com/security/cve/CVE-2026-23334/	self
https://www.suse.com/security/cve/CVE-2026-23336/	self
https://www.suse.com/security/cve/CVE-2026-23339/	self
https://www.suse.com/security/cve/CVE-2026-23340/	self
https://www.suse.com/security/cve/CVE-2026-23346/	self
https://www.suse.com/security/cve/CVE-2026-23347/	self
https://www.suse.com/security/cve/CVE-2026-23351/	self
https://www.suse.com/security/cve/CVE-2026-23354/	self
https://www.suse.com/security/cve/CVE-2026-23357/	self
https://www.suse.com/security/cve/CVE-2026-23360/	self
https://www.suse.com/security/cve/CVE-2026-23362/	self
https://www.suse.com/security/cve/CVE-2026-23363/	self
https://www.suse.com/security/cve/CVE-2026-23365/	self
https://www.suse.com/security/cve/CVE-2026-23367/	self
https://www.suse.com/security/cve/CVE-2026-23368/	self
https://www.suse.com/security/cve/CVE-2026-23369/	self
https://www.suse.com/security/cve/CVE-2026-23370/	self
https://www.suse.com/security/cve/CVE-2026-23372/	self
https://www.suse.com/security/cve/CVE-2026-23373/	self
https://www.suse.com/security/cve/CVE-2026-23374/	self
https://www.suse.com/security/cve/CVE-2026-23375/	self
https://www.suse.com/security/cve/CVE-2026-23378/	self
https://www.suse.com/security/cve/CVE-2026-23382/	self
https://www.suse.com/security/cve/CVE-2026-23387/	self
https://www.suse.com/security/cve/CVE-2026-23391/	self
https://www.suse.com/security/cve/CVE-2026-23392/	self
https://www.suse.com/security/cve/CVE-2026-23395/	self
https://www.suse.com/security/cve/CVE-2026-23396/	self
https://www.suse.com/security/cve/CVE-2026-23397/	self
https://www.suse.com/security/cve/CVE-2026-23399/	self
https://www.suse.com/security/cve/CVE-2026-23401/	self
https://www.suse.com/security/cve/CVE-2026-23403/	self
https://www.suse.com/security/cve/CVE-2026-23404/	self
https://www.suse.com/security/cve/CVE-2026-23405/	self
https://www.suse.com/security/cve/CVE-2026-23406/	self
https://www.suse.com/security/cve/CVE-2026-23407/	self
https://www.suse.com/security/cve/CVE-2026-23408/	self
https://www.suse.com/security/cve/CVE-2026-23409/	self
https://www.suse.com/security/cve/CVE-2026-23410/	self
https://www.suse.com/security/cve/CVE-2026-23411/	self
https://www.suse.com/security/cve/CVE-2026-23417/	self
https://www.suse.com/security/cve/CVE-2026-23418/	self
https://www.suse.com/security/cve/CVE-2026-23420/	self
https://www.suse.com/security/cve/CVE-2026-23426/	self
https://www.suse.com/security/cve/CVE-2026-23434/	self
https://www.suse.com/security/cve/CVE-2026-23436/	self
https://www.suse.com/security/cve/CVE-2026-23437/	self
https://www.suse.com/security/cve/CVE-2026-23440/	self
https://www.suse.com/security/cve/CVE-2026-23441/	self
https://www.suse.com/security/cve/CVE-2026-23442/	self
https://www.suse.com/security/cve/CVE-2026-23443/	self
https://www.suse.com/security/cve/CVE-2026-23445/	self
https://www.suse.com/security/cve/CVE-2026-23446/	self
https://www.suse.com/security/cve/CVE-2026-23447/	self
https://www.suse.com/security/cve/CVE-2026-23448/	self
https://www.suse.com/security/cve/CVE-2026-23449/	self
https://www.suse.com/security/cve/CVE-2026-23450/	self
https://www.suse.com/security/cve/CVE-2026-23452/	self
https://www.suse.com/security/cve/CVE-2026-23454/	self
https://www.suse.com/security/cve/CVE-2026-23455/	self
https://www.suse.com/security/cve/CVE-2026-23456/	self
https://www.suse.com/security/cve/CVE-2026-23457/	self
https://www.suse.com/security/cve/CVE-2026-23458/	self
https://www.suse.com/security/cve/CVE-2026-23460/	self
https://www.suse.com/security/cve/CVE-2026-23461/	self
https://www.suse.com/security/cve/CVE-2026-23462/	self
https://www.suse.com/security/cve/CVE-2026-23463/	self
https://www.suse.com/security/cve/CVE-2026-23464/	self
https://www.suse.com/security/cve/CVE-2026-23465/	self
https://www.suse.com/security/cve/CVE-2026-23466/	self
https://www.suse.com/security/cve/CVE-2026-23468/	self
https://www.suse.com/security/cve/CVE-2026-23470/	self
https://www.suse.com/security/cve/CVE-2026-23472/	self
https://www.suse.com/security/cve/CVE-2026-23473/	self
https://www.suse.com/security/cve/CVE-2026-23474/	self
https://www.suse.com/security/cve/CVE-2026-23475/	self
https://www.suse.com/security/cve/CVE-2026-31389/	self
https://www.suse.com/security/cve/CVE-2026-31392/	self
https://www.suse.com/security/cve/CVE-2026-31393/	self
https://www.suse.com/security/cve/CVE-2026-31394/	self
https://www.suse.com/security/cve/CVE-2026-31395/	self
https://www.suse.com/security/cve/CVE-2026-31400/	self
https://www.suse.com/security/cve/CVE-2026-31402/	self
https://www.suse.com/security/cve/CVE-2026-31403/	self
https://www.suse.com/security/cve/CVE-2026-31405/	self
https://www.suse.com/security/cve/CVE-2026-31406/	self
https://www.suse.com/security/cve/CVE-2026-31407/	self
https://www.suse.com/security/cve/CVE-2026-31408/	self
https://www.suse.com/security/cve/CVE-2026-31411/	self
https://www.suse.com/security/cve/CVE-2026-31412/	self
https://www.suse.com/security/cve/CVE-2026-31415/	self
https://www.suse.com/security/cve/CVE-2026-31416/	self
https://www.suse.com/security/cve/CVE-2026-31417/	self
https://www.suse.com/security/cve/CVE-2026-31420/	self
https://www.suse.com/security/cve/CVE-2026-31421/	self
https://www.suse.com/security/cve/CVE-2026-31422/	self
https://www.suse.com/security/cve/CVE-2026-31423/	self
https://www.suse.com/security/cve/CVE-2026-31424/	self
https://www.suse.com/security/cve/CVE-2026-31425/	self
https://www.suse.com/security/cve/CVE-2026-31426/	self
https://www.suse.com/security/cve/CVE-2026-31427/	self
https://www.suse.com/security/cve/CVE-2026-31428/	self
https://www.suse.com/security/cve/CVE-2026-31435/	self
https://www.suse.com/security/cve/CVE-2026-31449/	self
https://www.suse.com/security/cve/CVE-2026-31453/	self
https://www.suse.com/security/cve/CVE-2026-31456/	self
https://www.suse.com/security/cve/CVE-2026-31470/	self
https://www.suse.com/security/cve/CVE-2026-31494/	self
https://www.suse.com/security/cve/CVE-2026-31496/	self
https://www.suse.com/security/cve/CVE-2026-31503/	self
https://www.suse.com/security/cve/CVE-2026-31504/	self
https://www.suse.com/security/cve/CVE-2026-31505/	self
https://www.suse.com/security/cve/CVE-2026-31507/	self
https://www.suse.com/security/cve/CVE-2026-31515/	self
https://www.suse.com/security/cve/CVE-2026-31519/	self
https://www.suse.com/security/cve/CVE-2026-31525/	self
https://www.suse.com/security/cve/CVE-2026-31526/	self
https://www.suse.com/security/cve/CVE-2026-31528/	self
https://www.suse.com/security/cve/CVE-2026-31533/	self
https://www.suse.com/security/cve/CVE-2026-31547/	self
https://www.suse.com/security/cve/CVE-2026-31550/	self
https://www.suse.com/security/cve/CVE-2026-31554/	self
https://www.suse.com/security/cve/CVE-2026-31565/	self
https://www.suse.com/security/cve/CVE-2026-31579/	self
https://www.suse.com/security/cve/CVE-2026-31586/	self
https://www.suse.com/security/cve/CVE-2026-31588/	self
https://www.suse.com/security/cve/CVE-2026-31644/	self
https://www.suse.com/security/cve/CVE-2026-31649/	self
https://www.suse.com/security/cve/CVE-2026-31658/	self
https://www.suse.com/security/cve/CVE-2026-31662/	self
https://www.suse.com/security/cve/CVE-2026-31666/	self
https://www.suse.com/security/cve/CVE-2026-31668/	self
https://www.suse.com/security/cve/CVE-2026-31669/	self
https://www.suse.com/security/cve/CVE-2026-31675/	self
https://www.suse.com/security/cve/CVE-2026-31678/	self
https://www.suse.com/security/cve/CVE-2026-31679/	self
https://www.suse.com/security/cve/CVE-2026-31681/	self
https://www.suse.com/security/cve/CVE-2026-31682/	self
https://www.suse.com/security/cve/CVE-2026-31684/	self
https://www.suse.com/security/cve/CVE-2026-31685/	self
https://www.suse.com/security/cve/CVE-2026-31691/	self
https://www.suse.com/security/cve/CVE-2026-31694/	self
https://www.suse.com/security/cve/CVE-2026-31700/	self
https://www.suse.com/security/cve/CVE-2026-31738/	self
https://www.suse.com/security/cve/CVE-2026-31787/	self
https://www.suse.com/security/cve/CVE-2026-43009/	self
https://www.suse.com/security/cve/CVE-2026-43025/	self
https://www.suse.com/security/cve/CVE-2026-43027/	self
https://www.suse.com/security/cve/CVE-2026-43037/	self
https://www.suse.com/security/cve/CVE-2026-43038/	self
https://www.suse.com/security/cve/CVE-2026-43045/	self
https://www.suse.com/security/cve/CVE-2026-43050/	self
https://www.suse.com/security/cve/CVE-2026-43060/	self
https://www.suse.com/security/cve/CVE-2026-43082/	self
https://www.suse.com/security/cve/CVE-2026-43088/	self
https://www.suse.com/security/cve/CVE-2026-43153/	self
https://www.suse.com/security/cve/CVE-2026-43190/	self
https://www.suse.com/security/cve/CVE-2026-43265/	self
https://www.suse.com/security/cve/CVE-2026-43329/	self
https://www.suse.com/security/cve/CVE-2026-43365/	self
https://www.suse.com/security/cve/CVE-2026-43366/	self
https://www.suse.com/security/cve/CVE-2026-43441/	self
https://www.suse.com/security/cve/CVE-2026-43494/	self
https://www.suse.com/security/cve/CVE-2026-43503/	self
https://www.suse.com/security/cve/CVE-2026-46333/	self
https://www.suse.com/security/cve/CVE-2023-20585	external
https://bugzilla.suse.com/1243603	external
https://www.suse.com/security/cve/CVE-2024-14027	external
https://bugzilla.suse.com/1259420	external
https://www.suse.com/security/cve/CVE-2025-40181	external
https://bugzilla.suse.com/1253471	external
https://www.suse.com/security/cve/CVE-2025-40219	external
https://bugzilla.suse.com/1254518	external
https://www.suse.com/security/cve/CVE-2025-68265	external
https://bugzilla.suse.com/1255360	external
https://www.suse.com/security/cve/CVE-2025-68310	external
https://bugzilla.suse.com/1255160	external
https://www.suse.com/security/cve/CVE-2025-71238	external
https://bugzilla.suse.com/1259186	external
https://www.suse.com/security/cve/CVE-2025-71268	external
https://bugzilla.suse.com/1259865	external
https://www.suse.com/security/cve/CVE-2025-71269	external
https://bugzilla.suse.com/1259889	external
https://www.suse.com/security/cve/CVE-2025-71302	external
https://bugzilla.suse.com/1264837	external
https://bugzilla.suse.com/1264838	external
https://www.suse.com/security/cve/CVE-2026-23168	external
https://bugzilla.suse.com/1258826	external
https://www.suse.com/security/cve/CVE-2026-23209	external
https://bugzilla.suse.com/1258518	external
https://bugzilla.suse.com/1258784	external
https://www.suse.com/security/cve/CVE-2026-23236	external
https://bugzilla.suse.com/1259199	external
https://bugzilla.suse.com/1259200	external
https://www.suse.com/security/cve/CVE-2026-23237	external
https://bugzilla.suse.com/1259222	external
https://www.suse.com/security/cve/CVE-2026-23245	external
https://bugzilla.suse.com/1259799	external
https://www.suse.com/security/cve/CVE-2026-23246	external
https://bugzilla.suse.com/1259806	external
https://www.suse.com/security/cve/CVE-2026-23253	external
https://bugzilla.suse.com/1259878	external
https://www.suse.com/security/cve/CVE-2026-23260	external
https://bugzilla.suse.com/1259873	external
https://www.suse.com/security/cve/CVE-2026-23261	external
https://bugzilla.suse.com/1259871	external
https://www.suse.com/security/cve/CVE-2026-23264	external
https://bugzilla.suse.com/1259869	external
https://www.suse.com/security/cve/CVE-2026-23266	external
https://bugzilla.suse.com/1259868	external
https://www.suse.com/security/cve/CVE-2026-23268	external
https://bugzilla.suse.com/1258850	external
https://bugzilla.suse.com/1259859	external
https://www.suse.com/security/cve/CVE-2026-23269	external
https://bugzilla.suse.com/1259857	external
https://www.suse.com/security/cve/CVE-2026-23271	external
https://bugzilla.suse.com/1260018	external
https://www.suse.com/security/cve/CVE-2026-23273	external
https://bugzilla.suse.com/1260010	external
https://www.suse.com/security/cve/CVE-2026-23276	external
https://bugzilla.suse.com/1260012	external
https://www.suse.com/security/cve/CVE-2026-23279	external
https://bugzilla.suse.com/1260468	external
https://www.suse.com/security/cve/CVE-2026-23290	external
https://bugzilla.suse.com/1260533	external
https://www.suse.com/security/cve/CVE-2026-23291	external
https://bugzilla.suse.com/1260483	external
https://www.suse.com/security/cve/CVE-2026-23298	external
https://bugzilla.suse.com/1260485	external
https://www.suse.com/security/cve/CVE-2026-23300	external
https://bugzilla.suse.com/1260538	external
https://www.suse.com/security/cve/CVE-2026-23307	external
https://bugzilla.suse.com/1260541	external
https://www.suse.com/security/cve/CVE-2026-23312	external
https://bugzilla.suse.com/1260561	external
https://www.suse.com/security/cve/CVE-2026-23313	external
https://bugzilla.suse.com/1260555	external
https://www.suse.com/security/cve/CVE-2026-23315	external
https://bugzilla.suse.com/1260549	external
https://www.suse.com/security/cve/CVE-2026-23316	external
https://bugzilla.suse.com/1260573	external
https://www.suse.com/security/cve/CVE-2026-23317	external
https://bugzilla.suse.com/1260562	external
https://bugzilla.suse.com/1260563	external
https://www.suse.com/security/cve/CVE-2026-23318	external
https://bugzilla.suse.com/1260536	external
https://www.suse.com/security/cve/CVE-2026-23321	external
https://bugzilla.suse.com/1260505	external
https://www.suse.com/security/cve/CVE-2026-23324	external
https://bugzilla.suse.com/1260507	external
https://www.suse.com/security/cve/CVE-2026-23325	external
https://bugzilla.suse.com/1260537	external
https://www.suse.com/security/cve/CVE-2026-23334	external
https://bugzilla.suse.com/1260571	external
https://www.suse.com/security/cve/CVE-2026-23336	external
https://bugzilla.suse.com/1260552	external
https://www.suse.com/security/cve/CVE-2026-23339	external
https://bugzilla.suse.com/1260581	external
https://www.suse.com/security/cve/CVE-2026-23340	external
https://bugzilla.suse.com/1260523	external
https://www.suse.com/security/cve/CVE-2026-23346	external
https://bugzilla.suse.com/1260529	external
https://www.suse.com/security/cve/CVE-2026-23347	external
https://bugzilla.suse.com/1260514	external
https://www.suse.com/security/cve/CVE-2026-23351	external
https://bugzilla.suse.com/1260526	external
https://www.suse.com/security/cve/CVE-2026-23354	external
https://bugzilla.suse.com/1260801	external
https://www.suse.com/security/cve/CVE-2026-23357	external
https://bugzilla.suse.com/1260532	external
https://www.suse.com/security/cve/CVE-2026-23360	external
https://bugzilla.suse.com/1260613	external
https://www.suse.com/security/cve/CVE-2026-23362	external
https://bugzilla.suse.com/1260489	external
https://www.suse.com/security/cve/CVE-2026-23363	external
https://bugzilla.suse.com/1260572	external
https://www.suse.com/security/cve/CVE-2026-23365	external
https://bugzilla.suse.com/1260800	external
https://www.suse.com/security/cve/CVE-2026-23367	external
https://bugzilla.suse.com/1260731	external
https://www.suse.com/security/cve/CVE-2026-23368	external
https://bugzilla.suse.com/1260530	external
https://www.suse.com/security/cve/CVE-2026-23369	external
https://bugzilla.suse.com/1260798	external
https://www.suse.com/security/cve/CVE-2026-23370	external
https://bugzilla.suse.com/1260504	external
https://www.suse.com/security/cve/CVE-2026-23372	external
https://bugzilla.suse.com/1260484	external
https://www.suse.com/security/cve/CVE-2026-23373	external
https://bugzilla.suse.com/1260528	external
https://www.suse.com/security/cve/CVE-2026-23374	external
https://bugzilla.suse.com/1260811	external
https://www.suse.com/security/cve/CVE-2026-23375	external
https://bugzilla.suse.com/1260576	external
https://www.suse.com/security/cve/CVE-2026-23378	external
https://bugzilla.suse.com/1260546	external
https://www.suse.com/security/cve/CVE-2026-23382	external
https://bugzilla.suse.com/1260551	external
https://www.suse.com/security/cve/CVE-2026-23387	external
https://bugzilla.suse.com/1260807	external
https://www.suse.com/security/cve/CVE-2026-23391	external
https://bugzilla.suse.com/1260566	external
https://www.suse.com/security/cve/CVE-2026-23392	external
https://bugzilla.suse.com/1260531	external
https://bugzilla.suse.com/1262016	external
https://www.suse.com/security/cve/CVE-2026-23395	external
https://bugzilla.suse.com/1260580	external
https://www.suse.com/security/cve/CVE-2026-23396	external
https://bugzilla.suse.com/1260729	external
https://www.suse.com/security/cve/CVE-2026-23397	external
https://bugzilla.suse.com/1260728	external
https://www.suse.com/security/cve/CVE-2026-23399	external
https://bugzilla.suse.com/1261020	external
https://www.suse.com/security/cve/CVE-2026-23401	external
https://bugzilla.suse.com/1261288	external
https://www.suse.com/security/cve/CVE-2026-23403	external
https://bugzilla.suse.com/1261287	external
https://www.suse.com/security/cve/CVE-2026-23404	external
https://bugzilla.suse.com/1258854	external
https://www.suse.com/security/cve/CVE-2026-23405	external
https://bugzilla.suse.com/1261295	external
https://www.suse.com/security/cve/CVE-2026-23406	external
https://bugzilla.suse.com/1258855	external
https://www.suse.com/security/cve/CVE-2026-23407	external
https://bugzilla.suse.com/1258855	external
https://bugzilla.suse.com/1261292	external
https://www.suse.com/security/cve/CVE-2026-23408	external
https://bugzilla.suse.com/1258857	external
https://www.suse.com/security/cve/CVE-2026-23409	external
https://bugzilla.suse.com/1258857	external
https://bugzilla.suse.com/1261294	external
https://www.suse.com/security/cve/CVE-2026-23410	external
https://bugzilla.suse.com/1258856	external
https://www.suse.com/security/cve/CVE-2026-23411	external
https://bugzilla.suse.com/1258851	external
https://bugzilla.suse.com/1258856	external
https://www.suse.com/security/cve/CVE-2026-23417	external
https://bugzilla.suse.com/1261410	external
https://www.suse.com/security/cve/CVE-2026-23418	external
https://bugzilla.suse.com/1261505	external
https://www.suse.com/security/cve/CVE-2026-23420	external
https://bugzilla.suse.com/1261503	external
https://www.suse.com/security/cve/CVE-2026-23426	external
https://bugzilla.suse.com/1261504	external
https://www.suse.com/security/cve/CVE-2026-23434	external
https://bugzilla.suse.com/1261601	external
https://www.suse.com/security/cve/CVE-2026-23436	external
https://bugzilla.suse.com/1261617	external
https://www.suse.com/security/cve/CVE-2026-23437	external
https://bugzilla.suse.com/1261635	external
https://bugzilla.suse.com/1261845	external
https://www.suse.com/security/cve/CVE-2026-23440	external
https://bugzilla.suse.com/1261641	external
https://www.suse.com/security/cve/CVE-2026-23441	external
https://bugzilla.suse.com/1261768	external
https://www.suse.com/security/cve/CVE-2026-23442	external
https://bugzilla.suse.com/1261581	external
https://www.suse.com/security/cve/CVE-2026-23443	external
https://bugzilla.suse.com/1261679	external
https://www.suse.com/security/cve/CVE-2026-23445	external
https://bugzilla.suse.com/1261702	external
https://www.suse.com/security/cve/CVE-2026-23446	external
https://bugzilla.suse.com/1261778	external
https://www.suse.com/security/cve/CVE-2026-23447	external
https://bugzilla.suse.com/1261751	external
https://www.suse.com/security/cve/CVE-2026-23448	external
https://bugzilla.suse.com/1261750	external
https://www.suse.com/security/cve/CVE-2026-23449	external
https://bugzilla.suse.com/1261779	external
https://bugzilla.suse.com/1262213	external
https://www.suse.com/security/cve/CVE-2026-23450	external
https://bugzilla.suse.com/1261584	external
https://bugzilla.suse.com/1262214	external
https://www.suse.com/security/cve/CVE-2026-23452	external
https://bugzilla.suse.com/1261618	external
https://www.suse.com/security/cve/CVE-2026-23454	external
https://bugzilla.suse.com/1261780	external
https://www.suse.com/security/cve/CVE-2026-23455	external
https://bugzilla.suse.com/1261687	external
https://www.suse.com/security/cve/CVE-2026-23456	external
https://bugzilla.suse.com/1261703	external
https://www.suse.com/security/cve/CVE-2026-23457	external
https://bugzilla.suse.com/1261686	external
https://www.suse.com/security/cve/CVE-2026-23458	external
https://bugzilla.suse.com/1261781	external
https://bugzilla.suse.com/1261782	external
https://www.suse.com/security/cve/CVE-2026-23460	external
https://bugzilla.suse.com/1261582	external
https://www.suse.com/security/cve/CVE-2026-23461	external
https://bugzilla.suse.com/1261707	external
https://bugzilla.suse.com/1261709	external
https://bugzilla.suse.com/1265552	external
https://www.suse.com/security/cve/CVE-2026-23462	external
https://bugzilla.suse.com/1261710	external
https://bugzilla.suse.com/1261711	external
https://bugzilla.suse.com/1265552	external
https://www.suse.com/security/cve/CVE-2026-23463	external
https://bugzilla.suse.com/1261713	external
https://www.suse.com/security/cve/CVE-2026-23464	external
https://bugzilla.suse.com/1261592	external
https://www.suse.com/security/cve/CVE-2026-23465	external
https://bugzilla.suse.com/1261685	external
https://www.suse.com/security/cve/CVE-2026-23466	external
https://bugzilla.suse.com/1261714	external
https://www.suse.com/security/cve/CVE-2026-23468	external
https://bugzilla.suse.com/1261692	external
https://www.suse.com/security/cve/CVE-2026-23470	external
https://bugzilla.suse.com/1261585	external
https://www.suse.com/security/cve/CVE-2026-23472	external
https://bugzilla.suse.com/1261636	external
https://www.suse.com/security/cve/CVE-2026-23473	external
https://bugzilla.suse.com/1261694	external
https://www.suse.com/security/cve/CVE-2026-23474	external
https://bugzilla.suse.com/1261602	external
https://www.suse.com/security/cve/CVE-2026-23475	external
https://bugzilla.suse.com/1261644	external
https://www.suse.com/security/cve/CVE-2026-31389	external
https://bugzilla.suse.com/1261789	external
https://www.suse.com/security/cve/CVE-2026-31392	external
https://bugzilla.suse.com/1261788	external
https://www.suse.com/security/cve/CVE-2026-31393	external
https://bugzilla.suse.com/1261719	external
https://www.suse.com/security/cve/CVE-2026-31394	external
https://bugzilla.suse.com/1261637	external
https://www.suse.com/security/cve/CVE-2026-31395	external
https://bugzilla.suse.com/1261786	external
https://www.suse.com/security/cve/CVE-2026-31400	external
https://bugzilla.suse.com/1261645	external
https://www.suse.com/security/cve/CVE-2026-31402	external
https://bugzilla.suse.com/1261638	external
https://bugzilla.suse.com/1261640	external
https://bugzilla.suse.com/1265160	external
https://www.suse.com/security/cve/CVE-2026-31403	external
https://bugzilla.suse.com/1261796	external
https://bugzilla.suse.com/1261912	external
https://www.suse.com/security/cve/CVE-2026-31405	external
https://bugzilla.suse.com/1261700	external
https://bugzilla.suse.com/1261701	external
https://www.suse.com/security/cve/CVE-2026-31406	external
https://bugzilla.suse.com/1261629	external
https://bugzilla.suse.com/1261630	external
https://www.suse.com/security/cve/CVE-2026-31407	external
https://bugzilla.suse.com/1261632	external
https://www.suse.com/security/cve/CVE-2026-31408	external
https://bugzilla.suse.com/1261797	external
https://bugzilla.suse.com/1261799	external
https://bugzilla.suse.com/1265552	external
https://www.suse.com/security/cve/CVE-2026-31411	external
https://bugzilla.suse.com/1261752	external
https://www.suse.com/security/cve/CVE-2026-31412	external
https://bugzilla.suse.com/1261896	external
https://www.suse.com/security/cve/CVE-2026-31415	external
https://bugzilla.suse.com/1262099	external
https://www.suse.com/security/cve/CVE-2026-31416	external
https://bugzilla.suse.com/1262100	external
https://www.suse.com/security/cve/CVE-2026-31417	external
https://bugzilla.suse.com/1262101	external
https://www.suse.com/security/cve/CVE-2026-31420	external
https://bugzilla.suse.com/1262055	external
https://www.suse.com/security/cve/CVE-2026-31421	external
https://bugzilla.suse.com/1262061	external
https://www.suse.com/security/cve/CVE-2026-31422	external
https://bugzilla.suse.com/1262054	external
https://www.suse.com/security/cve/CVE-2026-31423	external
https://bugzilla.suse.com/1262063	external
https://www.suse.com/security/cve/CVE-2026-31424	external
https://bugzilla.suse.com/1262053	external
https://www.suse.com/security/cve/CVE-2026-31425	external
https://bugzilla.suse.com/1262074	external
https://www.suse.com/security/cve/CVE-2026-31426	external
https://bugzilla.suse.com/1262078	external
https://www.suse.com/security/cve/CVE-2026-31427	external
https://bugzilla.suse.com/1262086	external
https://www.suse.com/security/cve/CVE-2026-31428	external
https://bugzilla.suse.com/1262087	external
https://www.suse.com/security/cve/CVE-2026-31435	external
https://bugzilla.suse.com/1262601	external
https://bugzilla.suse.com/1262772	external
https://www.suse.com/security/cve/CVE-2026-31449	external
https://bugzilla.suse.com/1262616	external
https://www.suse.com/security/cve/CVE-2026-31453	external
https://bugzilla.suse.com/1262617	external
https://www.suse.com/security/cve/CVE-2026-31456	external
https://bugzilla.suse.com/1262627	external
https://www.suse.com/security/cve/CVE-2026-31470	external
https://bugzilla.suse.com/1262665	external
https://bugzilla.suse.com/1262774	external
https://www.suse.com/security/cve/CVE-2026-31494	external
https://bugzilla.suse.com/1262671	external
https://www.suse.com/security/cve/CVE-2026-31496	external
https://bugzilla.suse.com/1262673	external
https://www.suse.com/security/cve/CVE-2026-31503	external
https://bugzilla.suse.com/1263077	external
https://www.suse.com/security/cve/CVE-2026-31504	external
https://bugzilla.suse.com/1263085	external
https://bugzilla.suse.com/1263088	external
https://www.suse.com/security/cve/CVE-2026-31505	external
https://bugzilla.suse.com/1263093	external
https://bugzilla.suse.com/1263094	external
https://www.suse.com/security/cve/CVE-2026-31507	external
https://bugzilla.suse.com/1263095	external
https://bugzilla.suse.com/1263096	external
https://www.suse.com/security/cve/CVE-2026-31515	external
https://bugzilla.suse.com/1262752	external
https://www.suse.com/security/cve/CVE-2026-31519	external
https://bugzilla.suse.com/1263012	external
https://www.suse.com/security/cve/CVE-2026-31525	external
https://bugzilla.suse.com/1262725	external
https://bugzilla.suse.com/1262726	external
https://www.suse.com/security/cve/CVE-2026-31526	external
https://bugzilla.suse.com/1262662	external
https://www.suse.com/security/cve/CVE-2026-31528	external
https://bugzilla.suse.com/1263001	external
https://bugzilla.suse.com/1263002	external
https://www.suse.com/security/cve/CVE-2026-31533	external
https://bugzilla.suse.com/1262758	external
https://bugzilla.suse.com/1262759	external
https://www.suse.com/security/cve/CVE-2026-31547	external
https://bugzilla.suse.com/1263018	external
https://www.suse.com/security/cve/CVE-2026-31550	external
https://bugzilla.suse.com/1263104	external
https://www.suse.com/security/cve/CVE-2026-31554	external
https://bugzilla.suse.com/1263107	external
https://bugzilla.suse.com/1263108	external
https://www.suse.com/security/cve/CVE-2026-31565	external
https://bugzilla.suse.com/1263064	external
https://www.suse.com/security/cve/CVE-2026-31579	external
https://bugzilla.suse.com/1263074	external
https://www.suse.com/security/cve/CVE-2026-31586	external
https://bugzilla.suse.com/1263176	external
https://bugzilla.suse.com/1263177	external
https://www.suse.com/security/cve/CVE-2026-31588	external
https://bugzilla.suse.com/1263165	external
https://bugzilla.suse.com/1263166	external
https://www.suse.com/security/cve/CVE-2026-31644	external
https://bugzilla.suse.com/1263048	external
https://bugzilla.suse.com/1263050	external
https://www.suse.com/security/cve/CVE-2026-31649	external
https://bugzilla.suse.com/1263582	external
https://bugzilla.suse.com/1263676	external
https://www.suse.com/security/cve/CVE-2026-31658	external
https://bugzilla.suse.com/1263052	external
https://www.suse.com/security/cve/CVE-2026-31662	external
https://bugzilla.suse.com/1263131	external
https://bugzilla.suse.com/1263132	external
https://www.suse.com/security/cve/CVE-2026-31666	external
https://bugzilla.suse.com/1263138	external
https://www.suse.com/security/cve/CVE-2026-31668	external
https://bugzilla.suse.com/1263140	external
https://www.suse.com/security/cve/CVE-2026-31669	external
https://bugzilla.suse.com/1263141	external
https://bugzilla.suse.com/1263144	external
https://www.suse.com/security/cve/CVE-2026-31675	external
https://bugzilla.suse.com/1263556	external
https://www.suse.com/security/cve/CVE-2026-31678	external
https://bugzilla.suse.com/1263562	external
https://bugzilla.suse.com/1279872	external
https://www.suse.com/security/cve/CVE-2026-31679	external
https://bugzilla.suse.com/1263592	external
https://www.suse.com/security/cve/CVE-2026-31681	external
https://bugzilla.suse.com/1263593	external
https://www.suse.com/security/cve/CVE-2026-31682	external
https://bugzilla.suse.com/1263595	external
https://www.suse.com/security/cve/CVE-2026-31684	external
https://bugzilla.suse.com/1263596	external
https://www.suse.com/security/cve/CVE-2026-31685	external
https://bugzilla.suse.com/1263668	external
https://bugzilla.suse.com/1263670	external
https://www.suse.com/security/cve/CVE-2026-31691	external
https://bugzilla.suse.com/1263604	external
https://www.suse.com/security/cve/CVE-2026-31694	external
https://bugzilla.suse.com/1263901	external
https://bugzilla.suse.com/1263902	external
https://www.suse.com/security/cve/CVE-2026-31700	external
https://bugzilla.suse.com/1263882	external
https://bugzilla.suse.com/1263927	external
https://www.suse.com/security/cve/CVE-2026-31738	external
https://bugzilla.suse.com/1264059	external
https://bugzilla.suse.com/1264060	external
https://www.suse.com/security/cve/CVE-2026-31787	external
https://bugzilla.suse.com/1262181	external
https://www.suse.com/security/cve/CVE-2026-43009	external
https://bugzilla.suse.com/1264014	external
https://www.suse.com/security/cve/CVE-2026-43025	external
https://bugzilla.suse.com/1263931	external
https://bugzilla.suse.com/1264253	external
https://www.suse.com/security/cve/CVE-2026-43027	external
https://bugzilla.suse.com/1263933	external
https://bugzilla.suse.com/1264252	external
https://www.suse.com/security/cve/CVE-2026-43037	external
https://bugzilla.suse.com/1263995	external
https://bugzilla.suse.com/1265197	external
https://www.suse.com/security/cve/CVE-2026-43038	external
https://bugzilla.suse.com/1264097	external
https://bugzilla.suse.com/1271648	external
https://www.suse.com/security/cve/CVE-2026-43045	external
https://bugzilla.suse.com/1263942	external
https://bugzilla.suse.com/1263943	external
https://www.suse.com/security/cve/CVE-2026-43050	external
https://bugzilla.suse.com/1264082	external
https://bugzilla.suse.com/1264083	external
https://www.suse.com/security/cve/CVE-2026-43060	external
https://bugzilla.suse.com/1264183	external
https://www.suse.com/security/cve/CVE-2026-43082	external
https://bugzilla.suse.com/1264233	external
https://www.suse.com/security/cve/CVE-2026-43088	external
https://bugzilla.suse.com/1264469	external
https://www.suse.com/security/cve/CVE-2026-43153	external
https://bugzilla.suse.com/1264586	external
https://bugzilla.suse.com/1265065	external
https://www.suse.com/security/cve/CVE-2026-43190	external
https://bugzilla.suse.com/1264848	external
https://bugzilla.suse.com/1264849	external
https://www.suse.com/security/cve/CVE-2026-43265	external
https://bugzilla.suse.com/1264427	external
https://www.suse.com/security/cve/CVE-2026-43329	external
https://bugzilla.suse.com/1265085	external
https://bugzilla.suse.com/1265317	external
https://www.suse.com/security/cve/CVE-2026-43365	external
https://bugzilla.suse.com/1265119	external
https://bugzilla.suse.com/1265120	external
https://www.suse.com/security/cve/CVE-2026-43366	external
https://bugzilla.suse.com/1265116	external
https://bugzilla.suse.com/1265117	external
https://www.suse.com/security/cve/CVE-2026-43441	external
https://bugzilla.suse.com/1264674	external
https://bugzilla.suse.com/1264675	external
https://www.suse.com/security/cve/CVE-2026-43494	external
https://bugzilla.suse.com/1265626	external
https://bugzilla.suse.com/1265945	external
https://www.suse.com/security/cve/CVE-2026-43503	external
https://bugzilla.suse.com/1265209	external
https://bugzilla.suse.com/1265960	external
https://bugzilla.suse.com/1266229	external
https://bugzilla.suse.com/1269878	external
https://bugzilla.suse.com/1270098	external
https://bugzilla.suse.com/1270100	external
https://www.suse.com/security/cve/CVE-2026-46333	external
https://bugzilla.suse.com/1265308	external
https://bugzilla.suse.com/1265384	external

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2023-20585 (GCVE-0-2023-20585)

Vulnerability from cvelistv5 – Published: 2026-04-16 18:42 – Updated: 2026-04-16 19:12

Summary

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity.

Severity

5.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-16 18:58 UTC

CWE

CWE-788 - Access of Memory Location After End of Buffer

Assigner

AMD mitre root

References

1 reference

URL	Tags
https://www.amd.com/en/resources/product-security…

Impacted products

4 products

Vendor	Product	Version
AMD	AMD EPYC™ 7003 Series Processors	Unaffected: SEV FW 1.37.23
AMD	AMD EPYC™ 9004 Series Processors	Unaffected: SEV FW 1.37.31
AMD	AMD EPYC™ Embedded 7003 Series Processors	Unaffected: EmbMilanPI-SP3 1.0.0.B
AMD	AMD EPYC™ Embedded 9004 Series Processors	Unaffected: EmbGenoaPI-1.0.0.A

Date Public

2026-04-16 18:42

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-20585",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T18:58:05.996293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T18:58:58.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 7003 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "SEV FW 1.37.23"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 9004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "SEV FW 1.37.31"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 Embedded 7003 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbMilanPI-SP3 1.0.0.B"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 Embedded 9004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbGenoaPI-1.0.0.A"
            }
          ]
        }
      ],
      "datePublic": "2026-04-16T18:42:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity."
            }
          ],
          "value": "Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "CWE-788  Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T19:12:06.991Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3016.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "AMD PSIRT Automation 1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2023-20585",
    "datePublished": "2026-04-16T18:42:28.281Z",
    "dateReserved": "2022-10-27T18:53:39.759Z",
    "dateUpdated": "2026-04-16T19:12:06.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-14027 (GCVE-0-2024-14027)

Vulnerability from cvelistv5 – Published: 2026-03-09 15:51 – Updated: 2026-05-23 15:35

Title

xattr: switch to CLASS(fd)

Summary

In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 ("xattr: switch to CLASS(fd)").

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/9a3a2ae5efbbcaed3…
https://git.kernel.org/stable/c/d151b94967c824700…
https://git.kernel.org/stable/c/a71874379ec8c6e78…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c03185f4a23e7f89d84c9981091770e876e64480 , < 9a3a2ae5efbbcaed37551218abed94e23c537157 (git) Affected: c3a5e3e872f3688ae0dc57bb78ca633921d96a91 , < d151b94967c8247005435b63fc60f8f4baa320da (git) Affected: c3a5e3e872f3688ae0dc57bb78ca633921d96a91 , < a71874379ec8c6e788a61d71b3ad014a8d9a5c08 (git) Affected: 8d5863cb33aa424fc27115ee945ad6b96ae2facb (git) Affected: 6.6.51 , < 6.6.133 (semver) Affected: 6.10.10 , < 6.11 (semver)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.6.133 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a3a2ae5efbbcaed37551218abed94e23c537157",
              "status": "affected",
              "version": "c03185f4a23e7f89d84c9981091770e876e64480",
              "versionType": "git"
            },
            {
              "lessThan": "d151b94967c8247005435b63fc60f8f4baa320da",
              "status": "affected",
              "version": "c3a5e3e872f3688ae0dc57bb78ca633921d96a91",
              "versionType": "git"
            },
            {
              "lessThan": "a71874379ec8c6e788a61d71b3ad014a8d9a5c08",
              "status": "affected",
              "version": "c3a5e3e872f3688ae0dc57bb78ca633921d96a91",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8d5863cb33aa424fc27115ee945ad6b96ae2facb",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.133",
              "status": "affected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.133",
                  "versionStartIncluding": "6.6.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/xattr: missing fdput() in fremovexattr error path\n\nIn the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a\nfile reference but returns early without calling fdput() when\nstrncpy_from_user() fails on the name argument. In multi-threaded processes\nwhere fdget() takes the slow path, this permanently leaks one\nfile reference per call, pinning the struct file and associated kernel\nobjects in memory. An unprivileged local user can exploit this to cause\nkernel memory exhaustion. The issue was inadvertently fixed by commit\na71874379ec8 (\"xattr: switch to CLASS(fd)\")."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:35:40.032Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a3a2ae5efbbcaed37551218abed94e23c537157"
        },
        {
          "url": "https://git.kernel.org/stable/c/d151b94967c8247005435b63fc60f8f4baa320da"
        },
        {
          "url": "https://git.kernel.org/stable/c/a71874379ec8c6e788a61d71b3ad014a8d9a5c08"
        }
      ],
      "title": "xattr: switch to CLASS(fd)",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-14027",
    "datePublished": "2026-03-09T15:51:12.634Z",
    "dateReserved": "2026-03-09T15:47:22.723Z",
    "dateUpdated": "2026-05-23T15:35:40.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-40181 (GCVE-0-2025-40181)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-05-11 21:44

Title

x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forced variable MTRR range. In most KVM-based setups, legacy devices such as the HPET and TPM are enumerated via ACPI. ACPI enumeration includes a Memory32Fixed entry, and optionally a SystemMemory descriptor for an OperationRegion, e.g. if the device needs to be accessed via a Control Method. If a SystemMemory entry is present, then the kernel's ACPI driver will auto-ioremap the region so that it can be accessed at will. However, the ACPI spec doesn't provide a way to enumerate the memory type of SystemMemory regions, i.e. there's no way to tell software that a region must be mapped as UC vs. WB, etc. As a result, Linux's ACPI driver always maps SystemMemory regions using ioremap_cache(), i.e. as WB on x86. The dedicated device drivers however, e.g. the HPET driver and TPM driver, want to map their associated memory as UC or WC, as accessing PCI devices using WB is unsupported. On bare metal and non-CoCO, the conflicting requirements "work" as firmware configures the PCI hole (and other device memory) to be UC in the MTRRs. So even though the ACPI mappings request WB, they are forced to UC- in the kernel's tracking due to the kernel properly handling the MTRR overrides, and thus are compatible with the drivers' requested WC/UC-. With force WB MTRRs on SNP and TDX guests, the ACPI mappings get their requested WB if the ACPI mappings are established before the dedicated driver code attempts to initialize the device. E.g. if acpi_init() runs before the corresponding device driver is probed, ACPI's WB mapping will "win", and result in the driver's ioremap() failing because the existing WB mapping isn't compatible with the requested WC/UC-. E.g. when a TPM is emulated by the hypervisor (ignoring the security implications of relying on what is allegedly an untrusted entity to store measurements), the TPM driver will request UC and fail: [ 1.730459] ioremap error for 0xfed40000-0xfed45000, requested 0x2, got 0x0 [ 1.732780] tpm_tis MSFT0101:00: probe with driver tpm_tis failed with error -12 Note, the '0x2' and '0x0' values refer to "enum page_cache_mode", not x86's memtypes (which frustratingly are an almost pure inversion; 2 == WB, 0 == UC). E.g. tracing mapping requests for TPM TIS yields: Mapping TPM TIS with req_type = 0 WARNING: CPU: 22 PID: 1 at arch/x86/mm/pat/memtype.c:530 memtype_reserve+0x2ab/0x460 Modules linked in: CPU: 22 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.16.0-rc7+ #2 VOLUNTARY Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/29/2025 RIP: 0010:memtype_reserve+0x2ab/0x460 __ioremap_caller+0x16d/0x3d0 ioremap_cache+0x17/0x30 x86_acpi_os_ioremap+0xe/0x20 acpi_os_map_iomem+0x1f3/0x240 acpi_os_map_memory+0xe/0x20 acpi_ex_system_memory_space_handler+0x273/0x440 acpi_ev_address_space_dispatch+0x176/0x4c0 acpi_ex_access_region+0x2ad/0x530 acpi_ex_field_datum_io+0xa2/0x4f0 acpi_ex_extract_from_field+0x296/0x3e0 acpi_ex_read_data_from_field+0xd1/0x460 acpi_ex_resolve_node_to_value+0x2ee/0x530 acpi_ex_resolve_to_value+0x1f2/0x540 acpi_ds_evaluate_name_path+0x11b/0x190 acpi_ds_exec_end_op+0x456/0x960 acpi_ps_parse_loop+0x27a/0xa50 acpi_ps_parse_aml+0x226/0x600 acpi_ps_execute_method+0x172/0x3e0 acpi_ns_evaluate+0x175/0x5f0 acpi_evaluate_object+0x213/0x490 acpi_evaluate_integer+0x6d/0x140 acpi_bus_get_status+0x93/0x150 acpi_add_single_object+0x43a/0x7c0 acpi_bus_check_add+0x149/0x3a0 acpi_bus_check_add_1+0x16/0x30 acpi_ns_walk_namespace+0x22c/0x360 acpi_walk_namespace+0x15c/0x170 acpi_bus_scan+0x1dd/0x200 acpi_scan_init+0xe5/0x2b0 acpi_init+0x264/0x5b0 do_one_i ---truncated---

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/34ff466f74d0fe1db…
https://git.kernel.org/stable/c/91ab8a21bda2d2d28…
https://git.kernel.org/stable/c/0dccbc75e18df8539…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8e690b817e38769dc2fa0e7473e5a5dc1fc25795 , < 34ff466f74d0fe1db8956f9c245e2bb2c67f67bf (git) Affected: 8e690b817e38769dc2fa0e7473e5a5dc1fc25795 , < 91ab8a21bda2d2d2842b6159ac060d9100433a3c (git) Affected: 8e690b817e38769dc2fa0e7473e5a5dc1fc25795 , < 0dccbc75e18df85399a71933d60b97494110f559 (git)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.54 , ≤ 6.12.* (semver) Unaffected: 6.17.4 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "34ff466f74d0fe1db8956f9c245e2bb2c67f67bf",
              "status": "affected",
              "version": "8e690b817e38769dc2fa0e7473e5a5dc1fc25795",
              "versionType": "git"
            },
            {
              "lessThan": "91ab8a21bda2d2d2842b6159ac060d9100433a3c",
              "status": "affected",
              "version": "8e690b817e38769dc2fa0e7473e5a5dc1fc25795",
              "versionType": "git"
            },
            {
              "lessThan": "0dccbc75e18df85399a71933d60b97494110f559",
              "status": "affected",
              "version": "8e690b817e38769dc2fa0e7473e5a5dc1fc25795",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP\n\nWhen running as an SNP or TDX guest under KVM, force the legacy PCI hole,\ni.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC\nvia a forced variable MTRR range.\n\nIn most KVM-based setups, legacy devices such as the HPET and TPM are\nenumerated via ACPI.  ACPI enumeration includes a Memory32Fixed entry, and\noptionally a SystemMemory descriptor for an OperationRegion, e.g. if the\ndevice needs to be accessed via a Control Method.\n\nIf a SystemMemory entry is present, then the kernel\u0027s ACPI driver will\nauto-ioremap the region so that it can be accessed at will.  However, the\nACPI spec doesn\u0027t provide a way to enumerate the memory type of\nSystemMemory regions, i.e. there\u0027s no way to tell software that a region\nmust be mapped as UC vs. WB, etc.  As a result, Linux\u0027s ACPI driver always\nmaps SystemMemory regions using ioremap_cache(), i.e. as WB on x86.\n\nThe dedicated device drivers however, e.g. the HPET driver and TPM driver,\nwant to map their associated memory as UC or WC, as accessing PCI devices\nusing WB is unsupported.\n\nOn bare metal and non-CoCO, the conflicting requirements \"work\" as firmware\nconfigures the PCI hole (and other device memory) to be UC in the MTRRs.\nSo even though the ACPI mappings request WB, they are forced to UC- in the\nkernel\u0027s tracking due to the kernel properly handling the MTRR overrides,\nand thus are compatible with the drivers\u0027 requested WC/UC-.\n\nWith force WB MTRRs on SNP and TDX guests, the ACPI mappings get their\nrequested WB if the ACPI mappings are established before the dedicated\ndriver code attempts to initialize the device.  E.g. if acpi_init()\nruns before the corresponding device driver is probed, ACPI\u0027s WB mapping\nwill \"win\", and result in the driver\u0027s ioremap() failing because the\nexisting WB mapping isn\u0027t compatible with the requested WC/UC-.\n\nE.g. when a TPM is emulated by the hypervisor (ignoring the security\nimplications of relying on what is allegedly an untrusted entity to store\nmeasurements), the TPM driver will request UC and fail:\n\n  [  1.730459] ioremap error for 0xfed40000-0xfed45000, requested 0x2, got 0x0\n  [  1.732780] tpm_tis MSFT0101:00: probe with driver tpm_tis failed with error -12\n\nNote, the \u00270x2\u0027 and \u00270x0\u0027 values refer to \"enum page_cache_mode\", not x86\u0027s\nmemtypes (which frustratingly are an almost pure inversion; 2 == WB, 0 == UC).\nE.g. tracing mapping requests for TPM TIS yields:\n\n Mapping TPM TIS with req_type = 0\n WARNING: CPU: 22 PID: 1 at arch/x86/mm/pat/memtype.c:530 memtype_reserve+0x2ab/0x460\n Modules linked in:\n CPU: 22 UID: 0 PID: 1 Comm: swapper/0 Tainted: G        W           6.16.0-rc7+ #2 VOLUNTARY\n Tainted: [W]=WARN\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/29/2025\n RIP: 0010:memtype_reserve+0x2ab/0x460\n  __ioremap_caller+0x16d/0x3d0\n  ioremap_cache+0x17/0x30\n  x86_acpi_os_ioremap+0xe/0x20\n  acpi_os_map_iomem+0x1f3/0x240\n  acpi_os_map_memory+0xe/0x20\n  acpi_ex_system_memory_space_handler+0x273/0x440\n  acpi_ev_address_space_dispatch+0x176/0x4c0\n  acpi_ex_access_region+0x2ad/0x530\n  acpi_ex_field_datum_io+0xa2/0x4f0\n  acpi_ex_extract_from_field+0x296/0x3e0\n  acpi_ex_read_data_from_field+0xd1/0x460\n  acpi_ex_resolve_node_to_value+0x2ee/0x530\n  acpi_ex_resolve_to_value+0x1f2/0x540\n  acpi_ds_evaluate_name_path+0x11b/0x190\n  acpi_ds_exec_end_op+0x456/0x960\n  acpi_ps_parse_loop+0x27a/0xa50\n  acpi_ps_parse_aml+0x226/0x600\n  acpi_ps_execute_method+0x172/0x3e0\n  acpi_ns_evaluate+0x175/0x5f0\n  acpi_evaluate_object+0x213/0x490\n  acpi_evaluate_integer+0x6d/0x140\n  acpi_bus_get_status+0x93/0x150\n  acpi_add_single_object+0x43a/0x7c0\n  acpi_bus_check_add+0x149/0x3a0\n  acpi_bus_check_add_1+0x16/0x30\n  acpi_ns_walk_namespace+0x22c/0x360\n  acpi_walk_namespace+0x15c/0x170\n  acpi_bus_scan+0x1dd/0x200\n  acpi_scan_init+0xe5/0x2b0\n  acpi_init+0x264/0x5b0\n  do_one_i\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:44:19.679Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/34ff466f74d0fe1db8956f9c245e2bb2c67f67bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/91ab8a21bda2d2d2842b6159ac060d9100433a3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dccbc75e18df85399a71933d60b97494110f559"
        }
      ],
      "title": "x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40181",
    "datePublished": "2025-11-12T21:56:25.930Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-05-11T21:44:19.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-40219 (GCVE-0-2025-40219)

Vulnerability from cvelistv5 – Published: 2025-12-04 14:50 – Updated: 2026-09-08 08:42

Title

PCI/IOV: Fix race between SR-IOV enable/disable and hotplug

Summary

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF removal inside sriov_del_vfs() and concurrent hot unplug by taking the PCI rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock was also taken in sriov_add_vfs() to protect addition of VFs. This approach however causes deadlock on trying to remove PFs with SR-IOV enabled because PFs disable SR-IOV during removal and this removal happens under the PCI rescan/remove lock. So the original fix had to be reverted. Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs hotplug higher up in the callchain by taking the lock in sriov_numvfs_store() before calling into the driver's sriov_configure() callback.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/3cddde484471c602b…
https://git.kernel.org/stable/c/d7673ac466eca37ec…
https://git.kernel.org/stable/c/7c37920c96b85ef42…
https://git.kernel.org/stable/c/1047ca2d816994f31…
https://git.kernel.org/stable/c/97c18f074ff1c12d0…
https://git.kernel.org/stable/c/bea1d373098b22d71…
https://git.kernel.org/stable/c/f3015627b6e9ddf85…
https://git.kernel.org/stable/c/a5338e365c4559d7b…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 3cddde484471c602bea04e6f384819d336a1ff84 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 7c37920c96b85ef4255a7acc795e99e63dd38d59 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 1047ca2d816994f31e1475e63e0c0b7825599747 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 97c18f074ff1c12d016a0753072a3afdfa0b9611 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < bea1d373098b22d7142da48750ce5526096425bc (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < f3015627b6e9ddf85cfeaf42405b3c194dde2c36 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < a5338e365c4559d7b4d7356116b0eb95b12e08d5 (git)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:42:55.399Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3cddde484471c602bea04e6f384819d336a1ff84",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "7c37920c96b85ef4255a7acc795e99e63dd38d59",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "1047ca2d816994f31e1475e63e0c0b7825599747",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "97c18f074ff1c12d016a0753072a3afdfa0b9611",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "bea1d373098b22d7142da48750ce5526096425bc",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "f3015627b6e9ddf85cfeaf42405b3c194dde2c36",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "a5338e365c4559d7b4d7356116b0eb95b12e08d5",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Fix race between SR-IOV enable/disable and hotplug\n\nCommit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking when\nenabling/disabling SR-IOV\") tried to fix a race between the VF removal\ninside sriov_del_vfs() and concurrent hot unplug by taking the PCI\nrescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock\nwas also taken in sriov_add_vfs() to protect addition of VFs.\n\nThis approach however causes deadlock on trying to remove PFs with SR-IOV\nenabled because PFs disable SR-IOV during removal and this removal happens\nunder the PCI rescan/remove lock. So the original fix had to be reverted.\n\nInstead of taking the PCI rescan/remove lock in sriov_add_vfs() and\nsriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs\nhotplug higher up in the callchain by taking the lock in\nsriov_numvfs_store() before calling into the driver\u0027s sriov_configure()\ncallback."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:45:05.429Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3cddde484471c602bea04e6f384819d336a1ff84"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c37920c96b85ef4255a7acc795e99e63dd38d59"
        },
        {
          "url": "https://git.kernel.org/stable/c/1047ca2d816994f31e1475e63e0c0b7825599747"
        },
        {
          "url": "https://git.kernel.org/stable/c/97c18f074ff1c12d016a0753072a3afdfa0b9611"
        },
        {
          "url": "https://git.kernel.org/stable/c/bea1d373098b22d7142da48750ce5526096425bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3015627b6e9ddf85cfeaf42405b3c194dde2c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5338e365c4559d7b4d7356116b0eb95b12e08d5"
        }
      ],
      "title": "PCI/IOV: Fix race between SR-IOV enable/disable and hotplug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40219",
    "datePublished": "2025-12-04T14:50:42.996Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-09-08T08:42:55.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68265 (GCVE-0-2025-68265)

Vulnerability from cvelistv5 – Published: 2025-12-16 14:47 – Updated: 2026-09-08 08:43

Title

nvme: fix admin request_queue lifetime

Summary

In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug: BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK> dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK>

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/4896491c497226022…
https://git.kernel.org/stable/c/a505f0ba36ab24176…
https://git.kernel.org/stable/c/e8061d02b49c5c901…
https://git.kernel.org/stable/c/e7dac681790556c13…
https://git.kernel.org/stable/c/03b3bcd319b3ab518…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: fe60e8c534118a288cd251a59d747cbf5c03e160 , < 4896491c497226022626c3acc46044fd182f943c (git) Affected: fe60e8c534118a288cd251a59d747cbf5c03e160 , < a505f0ba36ab24176c300d7ff56aff85c2977e6c (git) Affected: fe60e8c534118a288cd251a59d747cbf5c03e160 , < e8061d02b49c5c901980f58d91e96580e9a14acf (git) Affected: fe60e8c534118a288cd251a59d747cbf5c03e160 , < e7dac681790556c131854b97551337aa8042215b (git) Affected: fe60e8c534118a288cd251a59d747cbf5c03e160 , < 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 (git)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.62 , ≤ 6.12.* (semver) Unaffected: 6.17.12 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:43:08.651Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4896491c497226022626c3acc46044fd182f943c",
              "status": "affected",
              "version": "fe60e8c534118a288cd251a59d747cbf5c03e160",
              "versionType": "git"
            },
            {
              "lessThan": "a505f0ba36ab24176c300d7ff56aff85c2977e6c",
              "status": "affected",
              "version": "fe60e8c534118a288cd251a59d747cbf5c03e160",
              "versionType": "git"
            },
            {
              "lessThan": "e8061d02b49c5c901980f58d91e96580e9a14acf",
              "status": "affected",
              "version": "fe60e8c534118a288cd251a59d747cbf5c03e160",
              "versionType": "git"
            },
            {
              "lessThan": "e7dac681790556c131854b97551337aa8042215b",
              "status": "affected",
              "version": "fe60e8c534118a288cd251a59d747cbf5c03e160",
              "versionType": "git"
            },
            {
              "lessThan": "03b3bcd319b3ab5182bc9aaa0421351572c78ac0",
              "status": "affected",
              "version": "fe60e8c534118a288cd251a59d747cbf5c03e160",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.62",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.62",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.12",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller\u0027s admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller\u0027s \u0027put\u0027 to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires issuing an NVMe admin ioctl through a retained local namespace or controller file descriptor. A remote NVMe-oF peer can induce teardown, but cannot independently perform the stale-FD ioctl.\nAC:L - The attacker can retain the file descriptor across controller teardown and trigger the UAF afterward, so no narrow race must be won. Teardown can also be induced predictably in NVMe/TCP deployments through controlled connection failure.\nPR:L - A basic local user with access to the NVMe device can use an Identify admin command, which nvme_cmd_allowed() permits without CAP_SYS_ADMIN. User-namespace capabilities are therefore unnecessary.\nUI:N - No victim action is required once the attacker has opened the device; controller teardown may occur automatically or be attacker-influenced.\nS:U - The UAF compromises the same host kernel security authority containing the vulnerable NVMe and block-layer code. It does not inherently cross a VM, IOMMU, or equivalent boundary.\nC:H - The stale request_queue can be reclaimed and reused, allowing subsequent queue and request processing to access attacker-influenced freed-object contents. As a kernel UAF, this can plausibly provide information-disclosure primitives.\nI:H - Queue entry increments a refcount through the stale object, and successful reuse can drive request initialization through an unrelated queue and corrupt kernel memory. This is plausibly exploitable for arbitrary modification or control-flow hijacking.\nA:H - The reported UAF occurs in blk_queue_enter() and can cause an oops, panic, hang, or broader memory corruption. The retained stale descriptor permits repeated triggering."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:35.899Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4896491c497226022626c3acc46044fd182f943c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a505f0ba36ab24176c300d7ff56aff85c2977e6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8061d02b49c5c901980f58d91e96580e9a14acf"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7dac681790556c131854b97551337aa8042215b"
        },
        {
          "url": "https://git.kernel.org/stable/c/03b3bcd319b3ab5182bc9aaa0421351572c78ac0"
        }
      ],
      "title": "nvme: fix admin request_queue lifetime",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68265",
    "datePublished": "2025-12-16T14:47:05.303Z",
    "dateReserved": "2025-12-16T13:41:40.268Z",
    "dateUpdated": "2026-09-08T08:43:08.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68310 (GCVE-0-2025-68310)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:39 – Updated: 2026-05-11 21:50

Title

s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump

Summary

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do. During error recovery testing a pair of tasks was reported to be hung: mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working INFO: task kmcheck:72 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000 Call Trace: [<000000065256f030>] __schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<000000065256f572>] schedule_preempt_disabled+0x22/0x30 [<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8 [<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core] [<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core] [<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398 [<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0 INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000 Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace: [<000000065256f030>] __schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<0000000652172e28>] pci_wait_cfg+0x80/0xe8 [<0000000652172f94>] pci_cfg_access_lock+0x74/0x88 [<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core] [<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core] [<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core] [<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168 [<0000000652513212>] devlink_health_report+0x19a/0x230 [<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too: - task: kmcheck mlx5_unload_one() tries to acquire devlink lock while the PCI error recovery code has set pdev->block_cfg_access by way of pci_cfg_access_lock() - task: kworker mlx5_crdump_collect() tries to set block_cfg_access through pci_cfg_access_lock() while devlink_health_report() had acquired the devlink lock. A similar deadlock situation can be reproduced by requesting a crdump with > devlink health dump show pci/<BDF> reporter fw_fatal while PCI error recovery is executed on the same <BDF> physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with > zpcictl --reset-fw <BDF> Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with "kernel answers: Permission denied" - and we get a kernel log message of: mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 because the config read of VSC_SEMAPHORE is rejected by the underlying hardware. Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/d0df2503bc3c2be38…
https://git.kernel.org/stable/c/b63c061be622b17b4…
https://git.kernel.org/stable/c/3591d56ea9bfd3e7f…
https://git.kernel.org/stable/c/54f938d9f5693af8e…
https://git.kernel.org/stable/c/0fd20f65df6aa4304…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4cdf2f4e24ff0d345fc36ef6d6aec059333a261e , < d0df2503bc3c2be385ca2fd96585daad1870c7c5 (git) Affected: 4cdf2f4e24ff0d345fc36ef6d6aec059333a261e , < b63c061be622b17b495cbf78a6d5f2d4c3147f8e (git) Affected: 4cdf2f4e24ff0d345fc36ef6d6aec059333a261e , < 3591d56ea9bfd3e7fbbe70f749bdeed689d415f9 (git) Affected: 4cdf2f4e24ff0d345fc36ef6d6aec059333a261e , < 54f938d9f5693af8ed586a08db4af5d9da1f0f2d (git) Affected: 4cdf2f4e24ff0d345fc36ef6d6aec059333a261e , < 0fd20f65df6aa430454a0deed8f43efa91c54835 (git)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.159 , ≤ 6.1.* (semver) Unaffected: 6.6.117 , ≤ 6.6.* (semver) Unaffected: 6.12.58 , ≤ 6.12.* (semver) Unaffected: 6.17.8 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/pci/pci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0df2503bc3c2be385ca2fd96585daad1870c7c5",
              "status": "affected",
              "version": "4cdf2f4e24ff0d345fc36ef6d6aec059333a261e",
              "versionType": "git"
            },
            {
              "lessThan": "b63c061be622b17b495cbf78a6d5f2d4c3147f8e",
              "status": "affected",
              "version": "4cdf2f4e24ff0d345fc36ef6d6aec059333a261e",
              "versionType": "git"
            },
            {
              "lessThan": "3591d56ea9bfd3e7fbbe70f749bdeed689d415f9",
              "status": "affected",
              "version": "4cdf2f4e24ff0d345fc36ef6d6aec059333a261e",
              "versionType": "git"
            },
            {
              "lessThan": "54f938d9f5693af8ed586a08db4af5d9da1f0f2d",
              "status": "affected",
              "version": "4cdf2f4e24ff0d345fc36ef6d6aec059333a261e",
              "versionType": "git"
            },
            {
              "lessThan": "0fd20f65df6aa430454a0deed8f43efa91c54835",
              "status": "affected",
              "version": "4cdf2f4e24ff0d345fc36ef6d6aec059333a261e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/pci/pci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc\u0027s EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30\n [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8\n [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8\n [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88\n [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168\n [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230\n [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u003eblock_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u003cBDF\u003e physical function\nby mlx5_core\u0027s pci_error_handlers. On s390 this can be injected with\n  \u003e zpcictl --reset-fw \u003cBDF\u003e\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \"kernel answers: Permission denied\" -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390\u0027s\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc\u0027s EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:50:41.874Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0df2503bc3c2be385ca2fd96585daad1870c7c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b63c061be622b17b495cbf78a6d5f2d4c3147f8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3591d56ea9bfd3e7fbbe70f749bdeed689d415f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/54f938d9f5693af8ed586a08db4af5d9da1f0f2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fd20f65df6aa430454a0deed8f43efa91c54835"
        }
      ],
      "title": "s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68310",
    "datePublished": "2025-12-16T15:39:41.652Z",
    "dateReserved": "2025-12-16T14:48:05.294Z",
    "dateUpdated": "2026-05-11T21:50:41.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71238 (GCVE-0-2025-71238)

Vulnerability from cvelistv5 – Published: 2026-03-04 14:36 – Updated: 2026-06-11 17:53

Title

scsi: qla2xxx: Fix bsg_done() causing double free

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page [5353358.825196] PGD 100006067 P4D 0 [5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1 [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025 [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10 [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246 [5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000 [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000 [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000 [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090 [5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000 [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000 [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0 [5353358.825221] PKRU: 55555554 [5353358.825222] Call Trace: [5353358.825223] <TASK> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825232] ? sg_copy_buffer+0xc8/0x110 [5353358.825236] ? __die_body.cold+0x8/0xd [5353358.825238] ? page_fault_oops+0x134/0x170 [5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110 [5353358.825244] ? exc_page_fault+0xa8/0x150 [5353358.825247] ? asm_exc_page_fault+0x22/0x30 [5353358.825252] ? memcpy_erms+0x6/0x10 [5353358.825253] sg_copy_buffer+0xc8/0x110 [5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx] [5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx] Most routines in qla_bsg.c call bsg_done() only for success cases. However a few invoke it for failure case as well leading to a double free. Validate before calling bsg_done().

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/057a5bdc481e58ab8…
https://git.kernel.org/stable/c/f2bbb4db0e4a4fbd5…
https://git.kernel.org/stable/c/27ac9679c43a09e54…
https://git.kernel.org/stable/c/74e7458537cd9349c…
https://git.kernel.org/stable/c/871f6236da96c4a97…
https://git.kernel.org/stable/c/31f33b856d2324d86…
https://git.kernel.org/stable/c/708003e1bc857dd01…
https://git.kernel.org/stable/c/c2c68225b1456f4d0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < 057a5bdc481e58ab853117254867ffb22caf9f6e (git) Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720 (git) Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < 27ac9679c43a09e54e2d9aae9980ada045b428e0 (git) Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < 74e7458537cd9349cf019862e51491f670871707 (git) Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < 871f6236da96c4a9712b8a29d7f555f767a47e95 (git) Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < 31f33b856d2324d86bcaef295f4d210477a1c018 (git) Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < 708003e1bc857dd014d4c44278d7d77c26f91b1c (git) Affected: 1b81e7f3019d632a707e07927e946ffbbc102910 , < c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0 (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.251 , ≤ 5.10.* (semver) Unaffected: 5.15.201 , ≤ 5.15.* (semver) Unaffected: 6.1.164 , ≤ 6.1.* (semver) Unaffected: 6.6.127 , ≤ 6.6.* (semver) Unaffected: 6.12.74 , ≤ 6.12.* (semver) Unaffected: 6.18.13 , ≤ 6.18.* (semver) Unaffected: 6.19.3 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:22.897127Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T17:53:38.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_bsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "057a5bdc481e58ab853117254867ffb22caf9f6e",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            },
            {
              "lessThan": "f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            },
            {
              "lessThan": "27ac9679c43a09e54e2d9aae9980ada045b428e0",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            },
            {
              "lessThan": "74e7458537cd9349cf019862e51491f670871707",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            },
            {
              "lessThan": "871f6236da96c4a9712b8a29d7f555f767a47e95",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            },
            {
              "lessThan": "31f33b856d2324d86bcaef295f4d210477a1c018",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            },
            {
              "lessThan": "708003e1bc857dd014d4c44278d7d77c26f91b1c",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            },
            {
              "lessThan": "c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0",
              "status": "affected",
              "version": "1b81e7f3019d632a707e07927e946ffbbc102910",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_bsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.251",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.13",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix bsg_done() causing double free\n\nKernel panic observed on system,\n\n[5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000\n[5353358.825194] #PF: supervisor write access in kernel mode\n[5353358.825195] #PF: error_code(0x0002) - not-present page\n[5353358.825196] PGD 100006067 P4D 0\n[5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI\n[5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G        W    L    -------  ---  5.14.0-503.34.1.el9_5.x86_64 #1\n[5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025\n[5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10\n[5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246\n[5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000\n[5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000\n[5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000\n[5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090\n[5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000\n[5353358.825218] FS:  00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000\n[5353358.825219] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0\n[5353358.825221] PKRU: 55555554\n[5353358.825222] Call Trace:\n[5353358.825223]  \u003cTASK\u003e\n[5353358.825224]  ? show_trace_log_lvl+0x1c4/0x2df\n[5353358.825229]  ? show_trace_log_lvl+0x1c4/0x2df\n[5353358.825232]  ? sg_copy_buffer+0xc8/0x110\n[5353358.825236]  ? __die_body.cold+0x8/0xd\n[5353358.825238]  ? page_fault_oops+0x134/0x170\n[5353358.825242]  ? kernelmode_fixup_or_oops+0x84/0x110\n[5353358.825244]  ? exc_page_fault+0xa8/0x150\n[5353358.825247]  ? asm_exc_page_fault+0x22/0x30\n[5353358.825252]  ? memcpy_erms+0x6/0x10\n[5353358.825253]  sg_copy_buffer+0xc8/0x110\n[5353358.825259]  qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx]\n[5353358.825317]  qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]\n\nMost routines in qla_bsg.c call bsg_done() only for success cases.\nHowever a few invoke it for failure case as well leading to a double\nfree. Validate before calling bsg_done()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:57:00.763Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/057a5bdc481e58ab853117254867ffb22caf9f6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720"
        },
        {
          "url": "https://git.kernel.org/stable/c/27ac9679c43a09e54e2d9aae9980ada045b428e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/74e7458537cd9349cf019862e51491f670871707"
        },
        {
          "url": "https://git.kernel.org/stable/c/871f6236da96c4a9712b8a29d7f555f767a47e95"
        },
        {
          "url": "https://git.kernel.org/stable/c/31f33b856d2324d86bcaef295f4d210477a1c018"
        },
        {
          "url": "https://git.kernel.org/stable/c/708003e1bc857dd014d4c44278d7d77c26f91b1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0"
        }
      ],
      "title": "scsi: qla2xxx: Fix bsg_done() causing double free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71238",
    "datePublished": "2026-03-04T14:36:36.579Z",
    "dateReserved": "2026-02-18T14:25:13.845Z",
    "dateUpdated": "2026-06-11T17:53:38.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71268 (GCVE-0-2025-71268)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:40 – Updated: 2026-08-05 12:12

Title

btrfs: fix reservation leak in some error paths when inserting inline extent

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline extent If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the reserved qgroup data, resulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data() in such cases.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/f7156512c8166d385…
https://git.kernel.org/stable/c/28b97fcbbf5237796…
https://git.kernel.org/stable/c/f3ee1732851aec6fe…
https://git.kernel.org/stable/c/28768bd3abf9995a9…
https://git.kernel.org/stable/c/c1c050f92d8f6aac4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < f7156512c8166d385f574b9ec030479aa7b1e8c9 (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < 28b97fcbbf523779688e8de5fe55bf2dae3859f6 (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913 (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < 28768bd3abf9995a93f6e01bfce01c60622964dd (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < c1c050f92d8f6aac4e17f7f2230160794fceef0c (git)
Linux	Linux	Affected: 4.4 Unaffected: 0 , < 4.4 (semver) Unaffected: 6.1.163 , ≤ 6.1.* (semver) Unaffected: 6.6.124 , ≤ 6.6.* (semver) Unaffected: 6.12.70 , ≤ 6.12.* (semver) Unaffected: 6.18.10 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7156512c8166d385f574b9ec030479aa7b1e8c9",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "28b97fcbbf523779688e8de5fe55bf2dae3859f6",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "28768bd3abf9995a93f6e01bfce01c60622964dd",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "c1c050f92d8f6aac4e17f7f2230160794fceef0c",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reservation leak in some error paths when inserting inline extent\n\nIf we fail to allocate a path or join a transaction, we return from\n__cow_file_range_inline() without freeing the reserved qgroup data,\nresulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data()\nin such cases."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote attacker can reach Btrfs writeback through a guest-writable ksmbd or anonymous NFS export backed by the affected filesystem, using write-through or flush operations to force inline extent insertion.\nAC:L - On a qgroup-enabled deployment, the attacker can prepare many small inline writes and create concurrent memory pressure to induce the vulnerable allocation or transaction-handle failure; no victim-controlled race is required.\nPR:N - A writable guest SMB share or anonymous NFS export requires no authenticated privileges or kernel capabilities.\nUI:N - The attacker directly submits the writes and flush requests without requiring victim action.\nS:U - The leak affects Btrfs qgroup accounting within the same kernel and filesystem security authority.\nC:N - The bug neither exposes data nor creates an out-of-bounds read, use-after-free, or other memory-disclosure primitive.\nI:N - The defect only fails to release an accounting reservation and does not corrupt memory or modify filesystem data.\nA:H - Leaked reservations remain charged to the subvolume and its ancestor qgroups after delalloc cleanup and inode eviction, potentially exhausting a shared limit and denying all further writes until quotas are reset or the filesystem is remounted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:37.025Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7156512c8166d385f574b9ec030479aa7b1e8c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/28b97fcbbf523779688e8de5fe55bf2dae3859f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913"
        },
        {
          "url": "https://git.kernel.org/stable/c/28768bd3abf9995a93f6e01bfce01c60622964dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1c050f92d8f6aac4e17f7f2230160794fceef0c"
        }
      ],
      "title": "btrfs: fix reservation leak in some error paths when inserting inline extent",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71268",
    "datePublished": "2026-03-18T17:40:58.080Z",
    "dateReserved": "2026-03-17T09:08:18.457Z",
    "dateUpdated": "2026-08-05T12:12:37.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71269 (GCVE-0-2025-71269)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:40 – Updated: 2026-08-05 12:12

Title

btrfs: do not free data reservation in fallback from inline due to -ENOSPC

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc. However we were always freeing the reserved qgroup data, which is wrong since we will use data. Fix this by freeing the reserved qgroup data in __cow_file_range_inline() only if we are not doing the fallback (ret is <= 0).

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/3edd1f6c7c520536b…
https://git.kernel.org/stable/c/3a9fd45afadec1fbf…
https://git.kernel.org/stable/c/0a1fbbd780f04d1b6…
https://git.kernel.org/stable/c/6de3a371a8b9fd095…
https://git.kernel.org/stable/c/f8da41de0bff9eb1d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < 3edd1f6c7c520536b62b2904807033597554dbac (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < 3a9fd45afadec1fbfec72057b9473d509fa8b68c (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < 0a1fbbd780f04d1b6cf48dd327c866ba937de1c4 (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < 6de3a371a8b9fd095198b1aa68c22cc10a4c6961 (git) Affected: 94ed938aba557aa798acf496f09afb289b619fcd , < f8da41de0bff9eb1d774a7253da0c9f637c4470a (git)
Linux	Linux	Affected: 4.4 Unaffected: 0 , < 4.4 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.10 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3edd1f6c7c520536b62b2904807033597554dbac",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "3a9fd45afadec1fbfec72057b9473d509fa8b68c",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "0a1fbbd780f04d1b6cf48dd327c866ba937de1c4",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "6de3a371a8b9fd095198b1aa68c22cc10a4c6961",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            },
            {
              "lessThan": "f8da41de0bff9eb1d774a7253da0c9f637c4470a",
              "status": "affected",
              "version": "94ed938aba557aa798acf496f09afb289b619fcd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not free data reservation in fallback from inline due to -ENOSPC\n\nIf we fail to create an inline extent due to -ENOSPC, we will attempt to\ngo through the normal COW path, reserve an extent, create an ordered\nextent, etc. However we were always freeing the reserved qgroup data,\nwhich is wrong since we will use data. Fix this by freeing the reserved\nqgroup data in __cow_file_range_inline() only if we are not doing the\nfallback (ret is \u003c= 0)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote SMB or NFS client can reach the vulnerable Btrfs writeback path through ksmbd or nfsd when writing to a Btrfs-backed export.\nAC:L - The attacker can create and write many sub-sector files while pressuring metadata until inline insertion returns -ENOSPC; no uncontrollable race or memory layout is required.\nPR:N - A guest-writable SMB share or anonymously writable NFS export permits triggering the vulnerable path without prior authentication.\nUI:N - Exploitation requires only attacker-controlled file writes and no action by another user.\nS:U - The vulnerability affects quota enforcement and storage availability within the same kernel and filesystem security authority.\nC:N - The bug only releases quota reservation accounting prematurely and provides no memory disclosure or read primitive.\nI:N - No kernel memory or unauthorized file data is modified, and actual qgroup usage is still accounted at transaction commit.\nA:H - The reservation bypass can permit writes beyond the configured qgroup limit and exhaust shared filesystem capacity, causing persistent ENOSPC failures and service outage."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:38.082Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6de3a371a8b9fd095198b1aa68c22cc10a4c6961"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8da41de0bff9eb1d774a7253da0c9f637c4470a"
        }
      ],
      "title": "btrfs: do not free data reservation in fallback from inline due to -ENOSPC",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71269",
    "datePublished": "2026-03-18T17:40:58.949Z",
    "dateReserved": "2026-03-17T09:08:18.457Z",
    "dateUpdated": "2026-08-05T12:12:38.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71302 (GCVE-0-2025-71302)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:26 – Updated: 2026-08-05 12:12

Title

drm/panthor: fix for dma-fence safe access rules

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix for dma-fence safe access rules Commit 506aa8b02a8d6 ("dma-fence: Add safe access helpers and document the rules") details the dma-fence safe access rules. The most common culprit is that drm_sched_fence_get_timeline_name may race with group_free_queue.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/ab8c0de60f16d7e0b…
https://git.kernel.org/stable/c/eae60933abd11df01…
https://git.kernel.org/stable/c/efe24898485c5c831…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: de85488138247d034eb3241840424a54d660926b , < ab8c0de60f16d7e0b162ccbbb35fcf1f277c97c2 (git) Affected: de85488138247d034eb3241840424a54d660926b , < eae60933abd11df013876f647c9edbd35ce67615 (git) Affected: de85488138247d034eb3241840424a54d660926b , < efe24898485c5c831e629d9c6fb9350c35cb576f (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab8c0de60f16d7e0b162ccbbb35fcf1f277c97c2",
              "status": "affected",
              "version": "de85488138247d034eb3241840424a54d660926b",
              "versionType": "git"
            },
            {
              "lessThan": "eae60933abd11df013876f647c9edbd35ce67615",
              "status": "affected",
              "version": "de85488138247d034eb3241840424a54d660926b",
              "versionType": "git"
            },
            {
              "lessThan": "efe24898485c5c831e629d9c6fb9350c35cb576f",
              "status": "affected",
              "version": "de85488138247d034eb3241840424a54d660926b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: fix for dma-fence safe access rules\n\nCommit 506aa8b02a8d6 (\"dma-fence: Add safe access helpers and document\nthe rules\") details the dma-fence safe access rules. The most common\nculprit is that drm_sched_fence_get_timeline_name may race with\ngroup_free_queue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches the flaw through DRM ioctls on a local Panthor render node and SYNC_IOC_FILE_INFO on an exported sync-file.\nAC:L - The attacker controls both sides by querying the exported fence concurrently with GROUP_DESTROY or file closure and can repeat the race while spraying reclaimed heap objects.\nPR:L - All required Panthor, syncobj, and export operations are DRM_RENDER_ALLOW; ordinary-priority groups require neither DRM master nor a capability.\nUI:N - The attacker independently creates the VM, group, job, syncobj, and sync-file and triggers teardown without victim action.\nS:U - The vulnerability compromises resources governed by the same host kernel and does not inherently cross a VM or IOMMU security boundary.\nC:H - The exported scheduler fence can outlive the freed queue, allowing the timeline callback to dereference reclaimed scheduler and name data. Heap reclamation can provide a chosen source pointer whose contents are copied through SYNC_IOC_FILE_INFO, supporting repeated kernel-memory disclosure.\nI:H - This is a kernel heap use-after-free involving surviving dma-fence references into reclaimed queue state. Under conservative UAF scoring, attacker-influenced heap reuse is treated as potentially enabling arbitrary memory modification or control-flow hijacking.\nA:H - Dereferencing a stale or attacker-influenced scheduler-name pointer can cause a kernel fault, oops, or panic, and an unprivileged attacker can trigger the condition repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:44.474Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ab8c0de60f16d7e0b162ccbbb35fcf1f277c97c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/eae60933abd11df013876f647c9edbd35ce67615"
        },
        {
          "url": "https://git.kernel.org/stable/c/efe24898485c5c831e629d9c6fb9350c35cb576f"
        }
      ],
      "title": "drm/panthor: fix for dma-fence safe access rules",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71302",
    "datePublished": "2026-05-08T13:26:11.418Z",
    "dateReserved": "2026-05-08T13:14:33.087Z",
    "dateUpdated": "2026-08-05T12:12:44.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:21834-1

CVE-2023-20585 (GCVE-0-2023-20585)

CVE-2024-14027 (GCVE-0-2024-14027)

CVE-2025-40181 (GCVE-0-2025-40181)

CVE-2025-40219 (GCVE-0-2025-40219)

CVE-2025-68265 (GCVE-0-2025-68265)

CVE-2025-68310 (GCVE-0-2025-68310)

CVE-2025-71238 (GCVE-0-2025-71238)

CVE-2025-71268 (GCVE-0-2025-71268)

CVE-2025-71269 (GCVE-0-2025-71269)

CVE-2025-71302 (GCVE-0-2025-71302)

Tags

Sightings

Nomenclature

Related by attack behaviour